Malicious code in 2fasecretkey (npm)

The '2fasecretkey' npm package versions 1.1.2, 1.1.3, and 1.1.4 include a postinstall script that performs an HTTP GET request to a hardcoded IP address (http://185.14.92.233:7777/p.js) without any integrity checks. The response is saved to a temporary file and executed via a detached wscript.exe invocation of a VBS stager, which runs the Node executable with the downloaded payload in a hidden window. This remote code execution occurs at install time and is concealed from the user. The package's legitimate purpose as a TOTP helper does not justify this behavior, indicating malicious intent.

Installation of affected versions results in execution of arbitrary remote code fetched over an unencrypted and unauthenticated channel, potentially compromising the installing system. The hidden execution method conceals the activity from the user, increasing the risk of unnoticed compromise. There is no indication of known exploits in the wild at this time.

No official patch or remediation is currently available. Users should avoid installing versions 1.1.2, 1.1.3, and 1.1.4 of '2fasecretkey'. Consider removing the package if already installed. Monitor for vendor advisories for updates or official fixes. Since this is a malicious package, sourcing TOTP helpers from trusted and verified packages is recommended.