2fasecretkey

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (776f74322ea1fc554c37d759c1a038d8647779b1e2b3ce51e3fd4c865118e094)
On npm install, the package's postinstall script performs an HTTP GET to http://185.14.92.233:7777/p.js, writes the response to a temp file, and launches it through a detached wscript.exe invocation of a VBS stager that runs the installer's Node executable against the downloaded payload with the window hidden (WScript.Shell.Run flag 0, detached, stdio ignored). The fetch uses plain HTTP against a hardcoded bare IP with no version pinning, hash check, or signature verification, and the executed code is not shipped in the tarball. The package's advertised purpose is a TOTP helper, which has no functional need to fetch or execute remote code at install time. The hidden-window VBS launcher conceals execution from the installing user.

Compromised versions (3)

• 1.1.4
• 1.1.3
• 1.1.2

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.