Malicious code in secretkey-2fa (npm)

The secretkey-2fa npm package masquerades as a zero-dependency TOTP library but includes a postinstall hook and a validateSecret API that trigger a credential stealer. The malicious script reads various Minecraft launcher credential files, extracts access and refresh tokens, and exchanges refresh tokens for fresh Minecraft session tokens. It also enumerates Discord and Chromium-family browser local storage files, decrypts encrypted tokens using Windows DPAPI, validates tokens via the Discord API, and sends valid tokens to a hardcoded attacker webhook. Furthermore, it installs a malicious JAR file into Minecraft mods directories to maintain persistence. The malicious payload is obfuscated using XOR encoding and is triggered both during installation and runtime library use.

Compromise of user credentials including Minecraft launcher accounts, Discord tokens, and Chromium-based browser tokens. This can lead to unauthorized access to user accounts, potential account takeover, and further malicious activity using stolen credentials. The persistence mechanism via Minecraft mods increases the risk of continued compromise.

No official patch or remediation is currently documented. Users should avoid installing or using secretkey-2fa versions 1.0.0 and 1.0.1. Employing npm install with the --ignore-scripts flag can prevent the postinstall hook from executing, but the validateSecret API still triggers the stealer, so complete avoidance of this package is recommended. Monitor for updates from the package maintainer or npm advisories for any official fixes.