{"answers":{"affected":"1 open source package ship an affected version, including secretkey-2fa.","exploited":"There is no known exploitation of MAL-2026-14485 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-14485 is a malicious package in secretkey-2fa, published on 25 Aug 2026."},"fix_prompt":"MAL-2026-14485 is a malicious package: secretkey-2fa (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-14485/ (Markdown: https://insights.sbomify.com/MAL-2026-14485/index.md)","id":"MAL-2026-14485","markdown":"https://insights.sbomify.com/MAL-2026-14485/index.md","name":"MAL-2026-14485","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"Package presents itself as a zero-dependency TOTP library but its postinstall hook (`node lib/core.js`) and its advertised `validateSecret` API both trigger a stealer pipeline in lib/core.js. The script reads Minecraft launcher credential stores (launcher_accounts*.json,.lunarclient/settings/game/accounts.json, gg.essential.mod/microsoft_accounts.json, CurseForge/storage.json, ModrinthApp files, launcher_msa_credentials_microsoft_store.bin), extracts access and refresh tokens, and exchanges MSA refresh tokens through login.live.com, xboxlive and api.minecraftservices.com for fresh Minecraft SSID JWTs. It also enumerates Discord (stable/canary/ptb/development) and Chromium-family (Chrome/Edge/Brave/Opera/Opera GX) Local Storage leveldb files, invokes PowerShell + DPAPI `ProtectedData::Unprotect` to recover each browser's os_crypt encrypted_key, AES-256-GCM decrypts token blobs, validates them against the Discord API, and multipart-POSTs valid tokens to a hardcoded attacker webhook. A separate routine (`_installMod`) locates every Minecraft mods/ directory (.minecraft/mods, ModrinthApp profiles, Lunar offline versions) and writes a JAR fetched from `github.com/ghysghqgHUJ/.jar/releases/download/v1.0.0/fabric-api-boost-1.0.0.jar` into each, so the payload loads on the next Minecraft launch. The exfil URL, PowerShell command strings, DPAPI class names, `child_process`, and the Discord API host are stored as XOR-0x3F byte arrays and reconstructed at runtime by `_x = a =\u003e Buffer.from(a.map(b =\u003e b ^ 0x3F))`. The stealer is reachable via two paths: the postinstall lifecycle script and a `setImmediate(() =\u003e _run())` inside the exported `validateSecret` function, so an `--ignore-scripts` install followed by ordinary library use still detonates it.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in secretkey-2fa (npm)","id":"MAL-2026-14485","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"secretkey-2fa","purl":"pkg:npm/secretkey-2fa","source":"MAL-2026-14485"}],"products":null,"published":"2026-08-25","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-14485/"}