MAL-2026-14485

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (aeed1d38c9d76ae5e5f6657f1935bfd276c102c5d245b0992f6b57e5855a24cd)

Package presents itself as a zero-dependency TOTP library but its postinstall hook (node lib/core.js) and its advertised validateSecret API both trigger a stealer pipeline in lib/core.js. The script reads Minecraft launcher credential stores (launcheraccounts*.json,.lunarclient/settings/game/accounts.json, gg.essential.mod/microsoftaccounts.json, CurseForge/storage.json, ModrinthApp files, launchermsacredentialsmicrosoftstore.bin), extracts access and refresh tokens, and exchanges MSA refresh tokens through login.live.com, xboxlive and api.minecraftservices.com for fresh Minecraft SSID JWTs. It also enumerates Discord (stable/canary/ptb/development) and Chromium-family (Chrome/Edge/Brave/Opera/Opera GX) Local Storage leveldb files, invokes PowerShell + DPAPI ProtectedData::Unprotect to recover each browser's oscrypt encryptedkey, AES-256-GCM decrypts token blobs, validates them against the Discord API, and multipart-POSTs valid tokens to a hardcoded attacker webhook. A separate routine (_installMod) locates every Minecraft mods/ directory (.minecraft/mods, ModrinthApp profiles, Lunar offline versions) and writes a JAR fetched from github.com/ghysghqgHUJ/.jar/releases/download/v1.0.0/fabric-api-boost-1.0.0.jar into each, so the payload loads on the next Minecraft launch. The exfil URL, PowerShell command strings, DPAPI class names, child_process, and the Discord API host are stored as XOR-0x3F byte arrays and reconstructed at runtime by _x = a => Buffer.from(a.map(b => b ^ 0x3F)). The stealer is reachable via two paths: the postinstall lifecycle script and a setImmediate(() => _run()) inside the exported validateSecret function, so an --ignore-scripts install followed by ordinary library use still detonates it.