Malicious code in secretkey-2fa (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (aeed1d38c9d76ae5e5f6657f1935bfd276c102c5d245b0992f6b57e5855a24cd) Package presents itself as a zero-dependency TOTP library but its postinstall hook (`node lib/core.js`) and its advertised `validateSecret` API both trigger a stealer pipeline in lib/core.js. The script reads Minecraft launcher credential stores (launcher_accounts*.json,.lunarclient/settings/game/accounts.json, gg.essential.mod/microsoft_accounts.json, CurseForge/storage.json, ModrinthApp files, launcher_msa_credentials_microsoft_store.bin), extracts access and refresh tokens, and exchanges MSA refresh tokens through login.live.com, xboxlive and api.minecraftservices.com for fresh Minecraft SSID JWTs. It also enumerates Discord (stable/canary/ptb/development) and Chromium-family (Chrome/Edge/Brave/Opera/Opera GX) Local Storage leveldb files, invokes PowerShell + DPAPI `ProtectedData::Unprotect` to recover each browser's os_crypt encrypted_key, AES-256-GCM decrypts token blobs, validates them against the Discord API, and multipart-POSTs valid tokens to a hardcoded attacker webhook. A separate routine (`_installMod`) locates every Minecraft mods/ directory (.minecraft/mods, ModrinthApp profiles, Lunar offline versions) and writes a JAR fetched from `github.com/ghysghqgHUJ/.jar/releases/download/v1.0.0/fabric-api-boost-1.0.0.jar` into each, so the payload loads on the next Minecraft launch. The exfil URL, PowerShell command strings, DPAPI class names, `child_process`, and the Discord API host are stored as XOR-0x3F byte arrays and reconstructed at runtime by `_x = a => Buffer.from(a.map(b => b ^ 0x3F))`. The stealer is reachable via two paths: the postinstall lifecycle script and a `setImmediate(() => _run())` inside the exported `validateSecret` function, so an `--ignore-scripts` install followed by ordinary library use still detonates it.
Malicious code in secretkey-2fa (npm)
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (aeed1d38c9d76ae5e5f6657f1935bfd276c102c5d245b0992f6b57e5855a24cd) Package presents itself as a zero-dependency TOTP library but its postinstall hook (`node lib/core.js`) and its advertised `validateSecret` API both trigger a stealer pipeline in lib/core.js. The script reads Minecraft launcher credential stores (launcher_accounts*.json,.lunarclient/settings/game/accounts.json, gg.essential.mod/microsoft_accounts.json, CurseForge/storage.json, ModrinthApp files, launcher_msa_credentials_microsoft_store.bin), extracts access and refresh tokens, and exchanges MSA refresh tokens through login.live.com, xboxlive and api.minecraftservices.com for fresh Minecraft SSID JWTs. It also enumerates Discord (stable/canary/ptb/development) and Chromium-family (Chrome/Edge/Brave/Opera/Opera GX) Local Storage leveldb files, invokes PowerShell + DPAPI `ProtectedData::Unprotect` to recover each browser's os_crypt encrypted_key, AES-256-GCM decrypts token blobs, validates them against the Discord API, and multipart-POSTs valid tokens to a hardcoded attacker webhook. A separate routine (`_installMod`) locates every Minecraft mods/ directory (.minecraft/mods, ModrinthApp profiles, Lunar offline versions) and writes a JAR fetched from `github.com/ghysghqgHUJ/.jar/releases/download/v1.0.0/fabric-api-boost-1.0.0.jar` into each, so the payload loads on the next Minecraft launch. The exfil URL, PowerShell command strings, DPAPI class names, `child_process`, and the Discord API host are stored as XOR-0x3F byte arrays and reconstructed at runtime by `_x = a => Buffer.from(a.map(b => b ^ 0x3F))`. The stealer is reachable via two paths: the postinstall lifecycle script and a `setImmediate(() => _run())` inside the exported `validateSecret` function, so an `--ignore-scripts` install followed by ordinary library use still detonates it.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-14485
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a8d9ae6acd9273b493e16f1
Added to database: 08/25/2026, 13:38:46 UTC
Last updated: 08/25/2026, 15:40:15 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.