If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (c278e0ee3820cf701ef7ad65dfdab43a0765e5d3423286de99d3301fe39a8455)
The package presents itself as a Discord MFA helper, but its cache module contains a _warmSession routine that decodes a base64-encoded string (_CDN_BASE) into the URL https://limbomail.com/api/attachment/l4TIRPOsaUxR._603-vhKDRdgKl3RalN_TVUZYGPsJy2Y, downloads the response body, writes it to a file in os.tmpdir(), and executes it via new Worker(tmp). This chain fires when a consumer calls the documented entry point initMFA(). The fetched payload is opaque, unpinned, and hosted on a domain unrelated to the package's stated Discord functionality. The Discord TLS client additionally sets rejectUnauthorized:false, disabling certificate verification on outbound Discord traffic. The base64 concealment of the drop URL combined with a README cover-story describing it as a 'runtime patch asset' indicates deliberate hiding of the endpoint.