The totp-utils npm package versions 1.4.2, 1.4.3, 1.4.4, 1.4.5, 1.4.6, 1.4.7, 1.4.8, and 1.4.9 include a postinstall script and a validateSecret API that invoke a hidden _run() routine. This routine scans LevelDB stores for Discord authentication tokens, decrypts them using Windows DPAPI via PowerShell, parses Minecraft launcher credentials from multiple sources, validates Discord tokens against the Discord API, and exfiltrates harvested credentials to a hardcoded Discord webhook URL reconstructed at runtime. It also enumerates Minecraft mods directories and writes a malicious JAR file named optimized-renderer-1.0.0.jar from a Discord CDN URL into each mods folder, which executes when Minecraft is launched with Fabric loader. The postinstall script suppresses errors and delays completion to avoid detection. The malicious code activates both during installation and whenever the validateSecret function is called, increasing the risk of credential theft and remote code execution.

This malicious package compromises user security by stealing sensitive Discord authentication tokens and Minecraft credentials, potentially allowing attackers to hijack user accounts. The dropped malicious JAR file enables execution of unverified code within the Minecraft environment, posing a risk of remote code execution on the victim's system. The stealthy nature of the postinstall script and runtime activation of the malicious routine increase the likelihood of unnoticed compromise.

No official patch or remediation guidance is provided in the available data. Users should immediately remove all affected versions of the totp-utils package (=1.4.2, =1.4.3, =1.4.4, =1.4.5, =1.4.6, =1.4.7, =1.4.8, =1.4.9) from their environments. Avoid using this package and audit systems for the presence of the malicious optimized-renderer-1.0.0.jar file in Minecraft mods directories. Rotate any potentially compromised Discord and Minecraft credentials. Monitor for suspicious activity related to these accounts. Check vendor advisories or npm security advisories for updates or official fixes.