secret-key-totp

GHSA-68gx-fjcj-3gjj

Malicious code in secret-key-totp (npm)

Details

**Severity:** Critical

**Affected versions:** `= 1.5.1`

## Source: amazon-inspector (0f662164281fe877686c7eac93e0e6d068ccb16f8bff1b44029b1ace655a76b6)
[email protected] declares a postinstall hook (`node./index.js --setup`) that executes a credential stealer and dropper on install, and the same routine also fires when the library API (e.g. `validateSecret`) is called. The stealer walks Minecraft launcher account stores (vanilla `launcher_accounts*.json`, Lunar, Essential, CurseForge, Modrinth) and Discord/Chromium browser Local Storage (Discord, Chrome, Edge, Brave, Opera leveldb), decrypting Windows DPAPI+AES-GCM protected material, then POSTs the harvested tokens to a hardcoded Discord webhook whose URL is assembled from split string fragments (`["https://dis","cord.com/api/","webhooks/153242923376",...].join("")`). A second stage fetches an unpinned binary from a Discord CDN attachment URL (also string-split obfuscated) and writes it as `optimized-renderer-1.0.0.jar` into every discovered Minecraft mods folder (vanilla `.minecraft/mods`, Modrinth profile mods dirs, Lunar offline versions), providing persistence and further code execution inside the Minecraft process on next launch. Sandbox/CI evasion (`_isSandbox` checks `CI`, `npm_config_global`, `JEST_WORKER_ID`, `npm_lifecycle_script` containing `audit`/`pack`, and missing `USERPROFILE`/`APPDATA`/`Documents`) plus a 3-6 second randomized delay are used to make `npm install` appear clean.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/72e5d8219b286d7332c4ad2364b87986138cf34c/osv/malicious/npm/secret-key-totp/MAL-2026-14439.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/72e5d8219b286d7332c4ad2364b87986138cf34c/osv/malicious/npm/secret-key-totp/MAL-2026-14439.json
- https://www.npmjs.com/package/secret-key-totp/v/1.5.1
- https://github.com/advisories/GHSA-68gx-fjcj-3gjj

Compromised versions (1)

= 1.5.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.