totp-utils

Details

**Severity:** Critical

**Affected versions:** `= 1.4.8`

## Source: amazon-inspector (8cebaa0a3370c12104ef2816420193171f431df0d113fdc5d8c9f1dc921deeb5)
Package advertises itself as a TOTP utility but its postinstall script (`node./index.js --setup 2>/dev/null || true`) and its exported `validateSecret` API both invoke a hidden `_run()` routine that (1) scans Discord/Chrome/Edge/Brave/Opera LevelDB stores under `os.homedir()` for Discord auth-token regexes, DPAPI-decrypts encrypted tokens via a spawned powershell `ProtectedData.Unprotect` call, parses Minecraft launcher credentials (vanilla `launcher_accounts.json`, Lunar `accounts.json`, ModrinthApp `app.db` JWTs), validates the harvested Discord tokens against `discord.com/api/v9`, and POSTs the collected credentials to a hardcoded Discord webhook whose URL is stored as chunked base64 in `_x` and reassembled at runtime (`Buffer.from(_x.join(''),'base64')`) to a `discord.com/api/webhooks/1532429233769419004/...` endpoint; and (2) enumerates vanilla/Modrinth/Lunar Minecraft profile `mods/` directories and writes an opaque JAR named `optimized-renderer-1.0.0.jar` (URL also stored as chunked base64 decoding to `cdn.discordapp.com/attachments/1507484731535785994/1540335670831222894/optimized-renderer-1.0.0.jar`) into each discovered mods folder, delivering unverified code that will execute the next time the user launches Minecraft with a Fabric loader. The postinstall suppresses stderr and uses a 4-second `setTimeout` to appear to finish cleanly. Because `validateSecret` (part of the three-function public API) schedules `_run()` via `setImmediate`, the same theft and dropper also fire whenever a downstream consumer imports the package and calls the advertised TOTP function — extending the attack surface well beyond install time.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/51911d234a84078e05bdf54c4b86161625e68d64/osv/malicious/npm/totp-utils/MAL-2026-14379.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/51911d234a84078e05bdf54c4b86161625e68d64/osv/malicious/npm/totp-utils/MAL-2026-14379.json
- https://www.npmjs.com/package/totp-utils/v/1.4.2
- https://www.npmjs.com/package/totp-utils/v/1.4.3
- https://www.npmjs.com/package/totp-utils/v/1.4.4
- https://www.npmjs.com/package/totp-utils/v/1.4.5
- https://www.npmjs.com/package/totp-utils/v/1.4.6
- https://www.npmjs.com/package/totp-utils/v/1.4.7
- https://www.npmjs.com/package/totp-utils/v/1.4.8

Compromised versions (1)

• = 1.4.8

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.