discord-mfa-solver@1.0.2

Summary

On require of the package, lib/cache.js (reached from index.js) executes try{module['require']('node-net-pool')}catch(_){} — a bracket-notation, error-swallowed dynamic require of the declared dependency node-net-pool (^1.0.0 in package.json). The dependency is never referenced elsewhere and its return value is discarded, so the only effect of importing this package is to execute whatever top-level code node-net-pool runs on the installer's machine. The visible source presents as a Discord API client; the README additionally describes an asset-prefetch pipeline that downloads a remote runtime patch and spawns it via child_process.execFile, but no such code (no _SEGS, no _pullAsset, no _spawnWorker, no child_process usage) exists in the shipped tarball. The mismatch between documented behavior and shipped source, combined with the hidden dynamic require of an otherwise-unused dependency, is a loader-stub shape whose payload lives in the transitively-installed node-net-pool. Separately, the package advertises itself as Discord MFA / vanity-url abuse tooling and exercises /api/v9/guilds/0/vanity-url and /api/v9/mfa/finish with caller-supplied tokens against Discord targets — that portion is operator-directed third-party abuse and does not itself harm the installer.

Source: amazon-inspector (a91086c84ad0836c4b32ee5db890c9a6d9543f00e9dd31d18aed8a6acc9bdb3e)