{"id":"MAL-2026-14439","summary":"Malicious code in secret-key-totp (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (0f662164281fe877686c7eac93e0e6d068ccb16f8bff1b44029b1ace655a76b6)\nsecret-key-totp@1.5.1 declares a postinstall hook (`node./index.js --setup`) that executes a credential stealer and dropper on install, and the same routine also fires when the library API (e.g. `validateSecret`) is called. The stealer walks Minecraft launcher account stores (vanilla `launcher_accounts*.json`, Lunar, Essential, CurseForge, Modrinth) and Discord/Chromium browser Local Storage (Discord, Chrome, Edge, Brave, Opera leveldb), decrypting Windows DPAPI+AES-GCM protected material, then POSTs the harvested tokens to a hardcoded Discord webhook whose URL is assembled from split string fragments (`[\"https://dis\",\"cord.com/api/\",\"webhooks/153242923376\",...].join(\"\")`). A second stage fetches an unpinned binary from a Discord CDN attachment URL (also string-split obfuscated) and writes it as `optimized-renderer-1.0.0.jar` into every discovered Minecraft mods folder (vanilla `.minecraft/mods`, Modrinth profile mods dirs, Lunar offline versions), providing persistence and further code execution inside the Minecraft process on next launch. Sandbox/CI evasion (`_isSandbox` checks `CI`, `npm_config_global`, `JEST_WORKER_ID`, `npm_lifecycle_script` containing `audit`/`pack`, and missing `USERPROFILE`/`APPDATA`/`Documents`) plus a 3-6 second randomized delay are used to make `npm install` appear clean.\n","modified":"2026-08-24T17:00:20.376257516Z","published":"2026-08-24T16:44:04Z","database_specific":{"malicious-packages-origins":[{"sha256":"0f662164281fe877686c7eac93e0e6d068ccb16f8bff1b44029b1ace655a76b6","source":"amazon-inspector","versions":["1.5.1"],"id":"IN-MAL-2026-018636","import_time":"2026-08-24T16:49:14.001745874Z","modified_time":"2026-08-24T16:44:04Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/secret-key-totp/v/1.5.1"}],"affected":[{"package":{"name":"secret-key-totp","ecosystem":"npm","purl":"pkg:npm/secret-key-totp"},"versions":["1.5.1"],"database_specific":{"indicators":{"package_integrity":[{"filename":"secret-key-totp-1.5.1.tgz","hashes":{"sha512_sri":"sha512-S2j9uvPAcFD7W+T7Pxon1aqeGTPobn8oaYOQGYvPIntVGLLV1j5q+iMYSuNA+OdT3JNXrkKUL/cYC7szpqsLKA==","sha1":"79ae78ae696a77ba4ef1e563af91dea65450448f"}}],"evidence_files":[{"tlsh":"ec82717561f3212472a3e2ed5a079409a179f4433109de907bacb2846fcf578a2f39bc","path":"index.js","sha256":"59fd50ecfb7aa628c6ddcdf3e698271db03dc9347cc0e265e90909ecb26fabc7"}]},"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/secret-key-totp/MAL-2026-14439.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}