Malicious Code Injection in passwordcrackv2: A Critical Security Threat
Summary
MAL-2026-17865: Malicious code in passwordcrackv2 (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
passwordcrackv2 is an npm package that claims to be a dependency-free library for Discord Multi-Factor Authentication (MFA). It is designed to facilitate secure access to Discord accounts. However, this package has been found to contain malicious code that compromises user security by executing unauthorized scripts.
Vulnerability Detail
The vulnerability in passwordcrackv2 arises from its deceptive nature, as it masquerades as a legitimate library while actually pulling in malicious code from an attacker-controlled repository. Upon loading, it executes a script that downloads and runs additional malicious software on the user's system, leading to potential data theft and unauthorized access. This vulnerability is particularly dangerous as it persists through various system mechanisms, ensuring that the malicious code remains active even after reboots.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall passwordcrackv2If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, you can avoid using passwordcrackv2 and look for alternative libraries that provide similar functionality without the associated risks. Always verify the integrity of packages before installation.
Conclusion
The discovery of malicious code within the passwordcrackv2 package highlights the importance of scrutinizing third-party libraries. Users should take immediate action to remove this package and consider using alternative solutions. Regular monitoring of dependencies is essential to maintain security.
See every vulnerability recorded for passwordcrackv2 →
FAQ
passwordcrackv2 is an npm package that claims to be a library for Discord MFA but has been found to contain malicious code.
The malicious code executes upon loading the package, downloading additional scripts from an attacker-controlled URL and running them on the user's system.
Using this package can lead to unauthorized access to your system, data theft, and persistent malware infections.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without requiring any signup.
Immediately uninstall the package using npm uninstall passwordcrackv2 and check your system for any signs of malicious activity.
