totp-utils @1.4.9

Summary

Package advertises itself as a TOTP utility but its postinstall script ( node./index.js --setup 2>/dev/null || true ) and its exported validateSecret API both invoke a hidden _run() routine that (1) scans Discord/Chrome/Edge/Brave/Opera LevelDB stores under os.homedir() for Discord auth-token regexes, DPAPI-decrypts encrypted tokens via a spawned powershell ProtectedData.Unprotect call, parses Minecraft launcher credentials (vanilla launcher_accounts.json , Lunar accounts.json , ModrinthApp app.db JWTs), validates the harvested Discord tokens against discord.com/api/v9 , and POSTs the collected credentials to a hardcoded Discord webhook whose URL is stored as chunked base64 in _x and reassembled at runtime ( Buffer.from(_x.join(''),'base64') ) to a discord.com/api/webhooks/1532429233769419004/... endpoint; and (2) enumerates vanilla/Modrinth/Lunar Minecraft profile mods/ directories and writes an opaque JAR named optimized-renderer-1.0.0.jar (URL also stored as chunked base64 decoding to cdn.discordapp.com/attachments/1507484731535785994/1540335670831222894/optimized-renderer-1.0.0.jar ) into each discovered mods folder, delivering unverified code that will execute the next time the user launches Minecraft with a Fabric loader. The postinstall suppresses stderr and uses a 4-second setTimeout to appear to finish cleanly. Because validateSecret (part of the three-function public API) schedules _run() via setImmediate , the same theft and dropper also fire whenever a downstream consumer imports the package and calls the advertised TOTP function — extending the attack surface well beyond install time.

Source: amazon-inspector (8cebaa0a3370c12104ef2816420193171f431df0d113fdc5d8c9f1dc921deeb5)