2fasecretkey

GHSA-x84q-q43p-hx9p

Malicious code in 2fasecretkey (npm)

Details

**Severity:** Critical

**Affected versions:** `= 1.1.4`

## Source: amazon-inspector (776f74322ea1fc554c37d759c1a038d8647779b1e2b3ce51e3fd4c865118e094)
On npm install, the package's postinstall script performs an HTTP GET to http://185.14.92.233:7777/p.js, writes the response to a temp file, and launches it through a detached wscript.exe invocation of a VBS stager that runs the installer's Node executable against the downloaded payload with the window hidden (WScript.Shell.Run flag 0, detached, stdio ignored). The fetch uses plain HTTP against a hardcoded bare IP with no version pinning, hash check, or signature verification, and the executed code is not shipped in the tarball. The package's advertised purpose is a TOTP helper, which has no functional need to fetch or execute remote code at install time. The hidden-window VBS launcher conceals execution from the installing user.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/e4956292c0cf024519ebae88e8b315a0af37a829/osv/malicious/npm/2fasecretkey/MAL-2026-15548.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/e4956292c0cf024519ebae88e8b315a0af37a829/osv/malicious/npm/2fasecretkey/MAL-2026-15548.json
- https://www.npmjs.com/package/2fasecretkey/v/1.1.2
- https://www.npmjs.com/package/2fasecretkey/v/1.1.3
- https://www.npmjs.com/package/2fasecretkey/v/1.1.4
- https://github.com/advisories/GHSA-x84q-q43p-hx9p

Compromised versions (1)

= 1.1.4

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.