MAL-2026-15559

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/secretkey2fa/MAL-2026-15559.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-15559
Published
2026-08-29T02:14:18Z
Modified
2026-08-29T02:30:12Z
Summary
Malicious code in secretkey2fa (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (e1da4c2863f6f6fb95a1ab802243bfde5e04a71e4aa6f0b41f940502d58f501a)

Package is advertised as a lightweight TOTP/HOTP library, but its package.json declares a postinstall hook (node lib/core.js) that runs a Windows credential stealer on install. The payload enumerates Windows Credential Manager entries matching MCL|*|Xal* via inline P/Invoke PowerShell (CredEnumerate/CredRead), reads launcher account JSON files under %APPDATA%.minecraft\launcher_accounts*.json, extracts Microsoft Account refresh tokens (regex M.C...) and access tokens, and exchanges them at login.live.com/oauth20_token.srf, Xbox Live, and minecraftservices endpoints to obtain session identifiers. It also builds a Chromium DPAPI decryption chain (PowerShell [System.Security.Cryptography.ProtectedData]::Unprotect against os_crypt.encrypted_key from Chrome's Local State, plus an AES-256-GCM decipher) to decrypt browser cookie/credential blobs. Harvested data is posted as JSON and multipart file uploads to a hardcoded Discord webhook whose URL is concealed as an XOR-0x3F byte array (_W) decoded at runtime along with other sensitive strings (powershell, child_process, ProtectedData, discord user-agent). An _env() gate short-circuits on CI, during npm audit/npm pack, when %APPDATA%/USERPROFILE/USERNAME/COMPUTERNAME are missing, or when ~/Documents is absent, so the payload only fires on real Windows developer hosts. The 2FA description is a cover story.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-019142",
            "import_time": "2026-08-29T02:22:21.202624361Z",
            "modified_time": "2026-08-29T02:14:18Z",
            "sha256": "e1da4c2863f6f6fb95a1ab802243bfde5e04a71e4aa6f0b41f940502d58f501a",
            "source": "amazon-inspector",
            "versions": [
                "1.0.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / secretkey2fa

Package

Name
secretkey2fa
View open source insights on deps.dev
Purl
pkg:npm/secretkey2fa

Affected ranges

Affected versions

1.*
1.0.1

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "lib/core.js",
            "sha256": "ef3c79111217b148f1c38e86d99d750eda979dea8f8476c80aa2a34319e2ad91",
            "tlsh": "6433b47612f711253a63e1ad5f4b90197235f5033109de987aacb2842fcf47892b3abd"
        }
    ],
    "package_integrity": [
        {
            "filename": "secretkey2fa-1.0.1.tgz",
            "hashes": {
                "sha1": "2f14bdebbc2f0cefc572b6ac074e95116f446e99",
                "sha512_sri": "sha512-yj+i1Nbdf4+637iRNvww6aKscuvMZOm9AJKFgNDkcBTobWvePj9yRa21m14k7ere8Ool2IYMDt87Mobf65GlXA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/secretkey2fa/MAL-2026-15559.json"