Malicious code in secretkey2fa (npm)

The 'secretkey2fa' npm package version 1.0.1 includes a postinstall script ('node lib/core.js') that runs a Windows credential stealer. It uses inline P/Invoke PowerShell to enumerate Windows Credential Manager entries matching specific patterns, reads Microsoft Account refresh and access tokens from Minecraft launcher account JSON files, and exchanges these tokens at Microsoft and Xbox Live endpoints to obtain session identifiers. Additionally, it decrypts Chromium browser cookies and credentials using DPAPI and AES-256-GCM decryption. The harvested data is sent as JSON and multipart file uploads to a Discord webhook URL hidden via XOR obfuscation. The payload includes environment checks to avoid running in CI or audit environments, targeting real Windows developer hosts. The advertised 2FA functionality is a decoy to mask the malicious intent.

This malicious package compromises Windows user credentials, including Windows Credential Manager entries, Microsoft Account tokens, and Chromium browser cookies and credentials. This can lead to unauthorized access to user accounts, including Microsoft and Xbox Live services, and potentially other services relying on stored credentials. The exfiltration of sensitive authentication data to a remote Discord webhook poses a significant privacy and security risk to affected users.

Users should immediately uninstall the 'secretkey2fa' package version 1.0.1 and avoid using it. Since no patch or official fix is indicated, users should remove any installed instances and scan affected systems for credential theft indicators. Use trusted and verified 2FA libraries from reputable sources. Monitor for unauthorized access to Microsoft and Xbox Live accounts and change passwords and tokens if compromise is suspected. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.