Malicious code in passwordcracker (npm)

passwordcracker poses as a dependency-free Discord MFA library but pulls node-net-pool from the attacker's GitHub repo lunexindonesia/node-net-pool, and on load lib/cache.js runs trymodule'require'catch to execute it. On Windows, that index.js downloads a script from a limbomail.com attachment UR...

Malicious Package

Overview passwordcracker is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-17864 Malicious code in passwordcracker (npm)

passwordcracker poses as a dependency-free Discord MFA library but pulls node-net-pool from the attacker's GitHub repo lunexindonesia/node-net-pool, and on load lib/cache.js runs trymodule'require'catch to execute it. On Windows, that index.js downloads a script from a limbomail.com attachment UR...

Malicious code in passwordcracker (npm)

passwordcracker poses as a dependency-free Discord MFA library but pulls node-net-pool from the attacker's GitHub repo lunexindonesia/node-net-pool, and on load lib/cache.js runs trymodule'require'catch to execute it. On Windows, that index.js downloads a script from a limbomail.com attachment UR...

Password Cracker: OSX

This module uses John the Ripper or Hashcat to identify weak passwords that have been acquired from OSX systems. The module will only crack xsha from OSX 10.4-10.6, xsha512 from 10.7, and PBKDF2 from OSX 10.8+. XSHA is 122 in hashcat. XSHA512 is 1722 in hashcat. PBKDF2 PBKDF2-HMAC-SHA512 is 7100 ...