Malicious code in 2fa-secretkey (npm)

The '2fa-secretkey' npm package, advertised as a TOTP/2FA helper, contains a postinstall script that launches a detached child process executing obfuscated malicious code. This code reconstructs a Discord webhook URL and uses PowerShell with inline C# to invoke Windows API calls to extract credentials from the Windows Credential Manager, including Microsoft authentication tokens. It also decrypts Chromium browser master keys and extracts cookies and stored credentials. The stolen data is sent to the attacker's Discord webhook. Execution is gated to real Windows user environments by checking environment variables and system paths. The affected versions are 1.0.1 through 1.0.7 inclusive.

This malicious package compromises the confidentiality of sensitive user credentials on Windows systems, including Microsoft account tokens and browser-stored secrets. The attacker can potentially hijack Microsoft services, Minecraft sessions, and browser sessions, leading to account takeover and unauthorized access. The exfiltration of this data to an external Discord webhook represents a severe privacy and security breach for users who installed the affected package versions.

No official patch or remediation is currently documented. Users should immediately uninstall the '2fa-secretkey' package versions 1.0.1 through 1.0.7 and avoid installing it. Review systems for signs of compromise, especially on Windows machines where the package was installed. Monitor for suspicious PowerShell activity and unauthorized network connections to Discord webhook URLs. Consider resetting affected Microsoft and Minecraft credentials and changing passwords for impacted accounts. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.