secret-key-totp @1.5.1

Summary

secret-key-totp@1.5.1 declares a postinstall hook ( node./index.js --setup ) that executes a credential stealer and dropper on install, and the same routine also fires when the library API (e.g. validateSecret ) is called. The stealer walks Minecraft launcher account stores (vanilla launcher_accounts*.json , Lunar, Essential, CurseForge, Modrinth) and Discord/Chromium browser Local Storage (Discord, Chrome, Edge, Brave, Opera leveldb), decrypting Windows DPAPI+AES-GCM protected material, then POSTs the harvested tokens to a hardcoded Discord webhook whose URL is assembled from split string fragments ( ["https://dis","cord.com/api/","webhooks/153242923376",...].join("") ). A second stage fetches an unpinned binary from a Discord CDN attachment URL (also string-split obfuscated) and writes it as optimized-renderer-1.0.0.jar into every discovered Minecraft mods folder (vanilla .minecraft/mods , Modrinth profile mods dirs, Lunar offline versions), providing persistence and further code execution inside the Minecraft process on next launch. Sandbox/CI evasion ( _isSandbox checks CI , npm_config_global , JEST_WORKER_ID , npm_lifecycle_script containing audit / pack , and missing USERPROFILE / APPDATA / Documents ) plus a 3-6 second randomized delay are used to make npm install appear clean.

Source: amazon-inspector (0f662164281fe877686c7eac93e0e6d068ccb16f8bff1b44029b1ace655a76b6)