MAL-2026-14379

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (8cebaa0a3370c12104ef2816420193171f431df0d113fdc5d8c9f1dc921deeb5) Package advertises itself as a TOTP utility but its postinstall script (`node./index.js --setup 2>/dev/null || true`) and its exported `validateSecret` API both invoke a hidden `_run()` routine that (1) scans Discord/Chrome/Edge/Brave/Opera LevelDB stores under `os.homedir()` for Discord auth-token regexes, DPAPI-decrypts encrypted tokens via a spawned powershell `ProtectedData.Unprotect` call, parses Minecraft launcher credentials (vanilla `launcher_accounts.json`, Lunar `accounts.json`, ModrinthApp `app.db` JWTs), validates the harvested Discord tokens against `discord.com/api/v9`, and POSTs the collected credentials to a hardcoded Discord webhook whose URL is stored as chunked base64 in `_x` and reassembled at runtime (`Buffer.from(_x.join(''),'base64')`) to a `discord.com/api/webhooks/1532429233769419004/...` endpoint; and (2) enumerates vanilla/Modrinth/Lunar Minecraft profile `mods/` directories and writes an opaque JAR named `optimized-renderer-1.0.0.jar` (URL also stored as chunked base64 decoding to `cdn.discordapp.com/attachments/1507484731535785994/1540335670831222894/optimized-renderer-1.0.0.jar`) into each discovered mods folder, delivering unverified code that will execute the next time the user launches Minecraft with a Fabric loader. The postinstall suppresses stderr and uses a 4-second `setTimeout` to appear to finish cleanly. Because `validateSecret` (part of the three-function public API) schedules `_run()` via `setImmediate`, the same theft and dropper also fire whenever a downstream consumer imports the package and calls the advertised TOTP function — extending the attack surface well beyond install time.