secretkey-2fa

{"modified":"2026-08-25T08:51:07Z","published":"2026-08-25T08:28:44Z","schema_version":"1.7.4","id":"MAL-2026-14485","summary":"Malicious code in secretkey-2fa (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (aeed1d38c9d76ae5e5f6657f1935bfd276c102c5d245b0992f6b57e5855a24cd)\nPackage presents itself as a zero-dependency TOTP library but its postinstall hook (`node lib/core.js`) and its advertised `validateSecret` API both trigger a stealer pipeline in lib/core.js. The script reads Minecraft launcher credential stores (launcher_accounts*.json,.lunarclient/settings/game/accounts.json, gg.essential.mod/microsoft_accounts.json, CurseForge/storage.json, ModrinthApp files, launcher_msa_credentials_microsoft_store.bin), extracts access and refresh tokens, and exchanges MSA refresh tokens through login.live.com, xboxlive and api.minecraftservices.com for fresh Minecraft SSID JWTs. It also enumerates Discord (stable/canary/ptb/development) and Chromium-family (Chrome/Edge/Brave/Opera/Opera GX) Local Storage leveldb files, invokes PowerShell + DPAPI `ProtectedData::Unprotect` to recover each browser's os_crypt encrypted_key, AES-256-GCM decrypts token blobs, validates them against the Discord API, and multipart-POSTs valid tokens to a hardcoded attacker webhook. A separate routine (`_installMod`) locates every Minecraft mods/ directory (.minecraft/mods, ModrinthApp profiles, Lunar offline versions) and writes a JAR fetched from `github.com/ghysghqgHUJ/.jar/releases/download/v1.0.0/fabric-api-boost-1.0.0.jar` into each, so the payload loads on the next Minecraft launch. The exfil URL, PowerShell command strings, DPAPI class names, `child_process`, and the Discord API host are stored as XOR-0x3F byte arrays and reconstructed at runtime by `_x = a => Buffer.from(a.map(b => b ^ 0x3F))`. The stealer is reachable via two paths: the postinstall lifecycle script and a `setImmediate(() => _run())` inside the exported `validateSecret` function, so an `--ignore-scripts` install followed by ordinary library use still detonates it.\n","affected":[{"package":{"ecosystem":"npm","name":"secretkey-2fa"},"versions":["1.0.0","1.0.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"lib/core.js","sha256":"917ef87670641d4552adbdc8222a11a7c6ca6cae05d2f529b6f836f93ce7347f","tlsh":"ffb2b67511f3202973a3e1ed4a1790196575f5033506de84bbacf2812fde47892b3abd"}],"package_integrity":[{"filename":"secretkey-2fa-1.0.0.tgz","hashes":{"sha1":"e43a88044489a203c24352c881e654c75a6d7a24","sha512_sri":"sha512-unKLfklkMkSst9nfiZWmFcrAWki+ACZUpn9uIrstR3SkrwdbgVLV1MwYPQ1DiImwNk4YeQo3nAtUcRJ8BBuuCQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/secretkey-2fa/v/1.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/secretkey-2fa/v/1.0.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018731","import_time":"2026-08-25T08:49:17.865206551Z","modified_time":"2026-08-25T08:28:51Z","sha256":"2c9445bdfb2382c249ea3233b16f97065cf6b615225735c306893d6221af3ca6","source":"amazon-inspector","versions":["1.0.0"]},{"id":"IN-MAL-2026-018730","import_time":"2026-08-25T08:49:17.758837454Z","modified_time":"2026-08-25T08:28:44Z","sha256":"aeed1d38c9d76ae5e5f6657f1935bfd276c102c5d245b0992f6b57e5855a24cd","source":"amazon-inspector","versions":["1.0.1"]}]}}