MAL-2026-14439
Malicious code in secret-key-totp (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (0f662164281fe877686c7eac93e0e6d068ccb16f8bff1b44029b1ace655a76b6) secret-key-totp@1.5.1 declares a postinstall hook (`node./index.js --setup`) that executes a credential stealer and dropper on install, and the same routine also fires when the library API (e.g. `validateSecret`) is called. The stealer walks Minecraft launcher account stores (vanilla `launcher_accounts*.json`, Lunar, Essential, CurseForge, Modrinth) and Discord/Chromium browser Local Storage (Discord, Chrome, Edge, Brave, Opera leveldb), decrypting Windows DPAPI+AES-GCM protected material, then POSTs the harvested tokens to a hardcoded Discord webhook whose URL is assembled from split string fragments (`["https://dis","cord.com/api/","webhooks/153242923376",...].join("")`). A second stage fetches an unpinned binary from a Discord CDN attachment URL (also string-split obfuscated) and writes it as `optimized-renderer-1.0.0.jar` into every discovered Minecraft mods folder (vanilla `.minecraft/mods`, Modrinth profile mods dirs, Lunar offline versions), providing persistence and further code execution inside the Minecraft process on next launch. Sandbox/CI evasion (`_isSandbox` checks `CI`, `npm_config_global`, `JEST_WORKER_ID`, `npm_lifecycle_script` containing `audit`/`pack`, and missing `USERPROFILE`/`APPDATA`/`Documents`) plus a 3-6 second randomized delay are used to make `npm install` appear clean.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for secret-key-totp (npm). Pin to a known-safe version or switch to an alternative.