MAL-2026-14439 Malicious code in secret-key-totp (npm)

[email protected] declares a postinstall hook (node./index.js --setup) that executes a credential stealer and dropper on install, and the same routine also fires when the library API (e.g. validateSecret) is called. The stealer walks Minecraft launcher account stores (vanilla launcher_accounts*.json, Lunar, Essential, CurseForge, Modrinth) and Discord/Chromium browser Local Storage (Discord, Chrome, Edge, Brave, Opera leveldb), decrypting Windows DPAPI+AES-GCM protected material, then POSTs the harvested tokens to a hardcoded Discord webhook whose URL is assembled from split string fragments (["https://dis","cord.com/api/","webhooks/153242923376",...].join("")). A second stage fetches an unpinned binary from a Discord CDN attachment URL (also string-split obfuscated) and writes it as optimized-renderer-1.0.0.jar into every discovered Minecraft mods folder (vanilla .minecraft/mods, Modrinth profile mods dirs, Lunar offline versions), providing persistence and further code execution inside the Minecraft process on next launch. Sandbox/CI evasion (_isSandbox checks CI, npm_config_global, JEST_WORKER_ID, npm_lifecycle_script containing audit/pack, and missing USERPROFILE/APPDATA/Documents) plus a 3-6 second randomized delay are used to make npm install appear clean.