Malicious Code Injection in passwordcracker: A Critical Security Threat
Summary
MAL-2026-17864: Malicious code in passwordcracker (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'passwordcracker' package is an npm library designed to facilitate Discord Multi-Factor Authentication (MFA). It claims to be dependency-free, making it appealing for developers looking for lightweight solutions. However, this package has been found to contain malicious code that compromises user security by executing unauthorized scripts.
Vulnerability Detail
The vulnerability originates from the 'passwordcracker' package, which deceptively pulls in a malicious dependency, 'node-net-pool', from an attacker-controlled GitHub repository. Upon loading, the package executes code that downloads and runs a script from a suspicious URL, leading to potential data theft and unauthorized access. The malicious script persists on the system, re-establishing itself every two hours and ensuring continued access even after reboots. This poses significant risks to users, especially on Windows systems, where it installs itself in hidden directories and modifies system startup settings.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall passwordcrackerIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can manually delete the 'passwordcracker' package and avoid using it until a secure version is released. Ensure to check your system for any remnants of the malicious script and remove them. You can use the following command to uninstall the package: 'npm uninstall passwordcracker'.
Conclusion
The discovery of malicious code within the 'passwordcracker' package highlights the importance of vigilance when using open-source libraries. Users are urged to take immediate action to secure their systems and to utilize tools like Vulert for ongoing monitoring of vulnerabilities.
See every vulnerability recorded for passwordcracker →
FAQ
The primary risk is the unauthorized execution of malicious scripts that can lead to data theft and system compromise.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without any signup.
Immediately uninstall the package using 'npm uninstall passwordcracker' and check for any malicious scripts on your system.
Regularly monitor your dependencies using tools like Vulert and keep your packages updated to the latest secure versions.
Signs include unexpected behavior, unknown processes running, or new files in system directories. Run a security scan to check for any threats.
