MAL-2026-14439

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/secret-key-totp/MAL-2026-14439.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14439
Published
2026-08-24T16:44:04Z
Modified
2026-08-24T17:00:20Z
Summary
Malicious code in secret-key-totp (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (0f662164281fe877686c7eac93e0e6d068ccb16f8bff1b44029b1ace655a76b6)

secret-key-totp@1.5.1 declares a postinstall hook (node./index.js --setup) that executes a credential stealer and dropper on install, and the same routine also fires when the library API (e.g. validateSecret) is called. The stealer walks Minecraft launcher account stores (vanilla launcher_accounts*.json, Lunar, Essential, CurseForge, Modrinth) and Discord/Chromium browser Local Storage (Discord, Chrome, Edge, Brave, Opera leveldb), decrypting Windows DPAPI+AES-GCM protected material, then POSTs the harvested tokens to a hardcoded Discord webhook whose URL is assembled from split string fragments (["https://dis","cord.com/api/","webhooks/153242923376",...].join("")). A second stage fetches an unpinned binary from a Discord CDN attachment URL (also string-split obfuscated) and writes it as optimized-renderer-1.0.0.jar into every discovered Minecraft mods folder (vanilla .minecraft/mods, Modrinth profile mods dirs, Lunar offline versions), providing persistence and further code execution inside the Minecraft process on next launch. Sandbox/CI evasion (_isSandbox checks CI, npm_config_global, JEST_WORKER_ID, npm_lifecycle_script containing audit/pack, and missing USERPROFILE/APPDATA/Documents) plus a 3-6 second randomized delay are used to make npm install appear clean.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-018636",
            "import_time": "2026-08-24T16:49:14.001745874Z",
            "modified_time": "2026-08-24T16:44:04Z",
            "sha256": "0f662164281fe877686c7eac93e0e6d068ccb16f8bff1b44029b1ace655a76b6",
            "source": "amazon-inspector",
            "versions": [
                "1.5.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / secret-key-totp

Package

Name
secret-key-totp
View open source insights on deps.dev
Purl
pkg:npm/secret-key-totp

Affected ranges

Affected versions

1.*
1.5.1

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "index.js",
            "sha256": "59fd50ecfb7aa628c6ddcdf3e698271db03dc9347cc0e265e90909ecb26fabc7",
            "tlsh": "ec82717561f3212472a3e2ed5a079409a179f4433109de907bacb2846fcf578a2f39bc"
        }
    ],
    "package_integrity": [
        {
            "filename": "secret-key-totp-1.5.1.tgz",
            "hashes": {
                "sha1": "79ae78ae696a77ba4ef1e563af91dea65450448f",
                "sha512_sri": "sha512-S2j9uvPAcFD7W+T7Pxon1aqeGTPobn8oaYOQGYvPIntVGLLV1j5q+iMYSuNA+OdT3JNXrkKUL/cYC7szpqsLKA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/secret-key-totp/MAL-2026-14439.json"