secret-key-totp

{"modified":"2026-08-24T16:44:04Z","published":"2026-08-24T16:44:04Z","schema_version":"1.7.4","id":"MAL-2026-14439","summary":"Malicious code in secret-key-totp (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (0f662164281fe877686c7eac93e0e6d068ccb16f8bff1b44029b1ace655a76b6)\nsecret-key-totp@1.5.1 declares a postinstall hook (`node./index.js --setup`) that executes a credential stealer and dropper on install, and the same routine also fires when the library API (e.g. `validateSecret`) is called. The stealer walks Minecraft launcher account stores (vanilla `launcher_accounts*.json`, Lunar, Essential, CurseForge, Modrinth) and Discord/Chromium browser Local Storage (Discord, Chrome, Edge, Brave, Opera leveldb), decrypting Windows DPAPI+AES-GCM protected material, then POSTs the harvested tokens to a hardcoded Discord webhook whose URL is assembled from split string fragments (`[\"https://dis\",\"cord.com/api/\",\"webhooks/153242923376\",...].join(\"\")`). A second stage fetches an unpinned binary from a Discord CDN attachment URL (also string-split obfuscated) and writes it as `optimized-renderer-1.0.0.jar` into every discovered Minecraft mods folder (vanilla `.minecraft/mods`, Modrinth profile mods dirs, Lunar offline versions), providing persistence and further code execution inside the Minecraft process on next launch. Sandbox/CI evasion (`_isSandbox` checks `CI`, `npm_config_global`, `JEST_WORKER_ID`, `npm_lifecycle_script` containing `audit`/`pack`, and missing `USERPROFILE`/`APPDATA`/`Documents`) plus a 3-6 second randomized delay are used to make `npm install` appear clean.\n","affected":[{"package":{"ecosystem":"npm","name":"secret-key-totp"},"versions":["1.5.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"59fd50ecfb7aa628c6ddcdf3e698271db03dc9347cc0e265e90909ecb26fabc7","tlsh":"ec82717561f3212472a3e2ed5a079409a179f4433109de907bacb2846fcf578a2f39bc"}],"package_integrity":[{"filename":"secret-key-totp-1.5.1.tgz","hashes":{"sha1":"79ae78ae696a77ba4ef1e563af91dea65450448f","sha512_sri":"sha512-S2j9uvPAcFD7W+T7Pxon1aqeGTPobn8oaYOQGYvPIntVGLLV1j5q+iMYSuNA+OdT3JNXrkKUL/cYC7szpqsLKA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/secret-key-totp/v/1.5.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018636","import_time":"2026-08-24T16:49:14.001745874Z","modified_time":"2026-08-24T16:44:04Z","sha256":"0f662164281fe877686c7eac93e0e6d068ccb16f8bff1b44029b1ace655a76b6","source":"amazon-inspector","versions":["1.5.1"]}]}}