totp-utils@1.4.9

Summary

Package advertises itself as a TOTP utility but its postinstall script (node./index.js --setup 2>/dev/null || true) and its exported validateSecret API both invoke a hidden _run() routine that (1) scans Discord/Chrome/Edge/Brave/Opera LevelDB stores under os.homedir() for Discord auth-token regexes, DPAPI-decrypts encrypted tokens via a spawned powershell ProtectedData.Unprotect call, parses Minecraft launcher credentials (vanilla launcher_accounts.json, Lunar accounts.json, ModrinthApp app.db JWTs), validates the harvested Discord tokens against discord.com/api/v9, and POSTs the collected credentials to a hardcoded Discord webhook whose URL is stored as chunked base64 in _x and reassembled at runtime (Buffer.from(_x.join(''),'base64')) to a discord.com/api/webhooks/1532429233769419004/... endpoint; and (2) enumerates vanilla/Modrinth/Lunar Minecraft profile mods/ directories and writes an opaque JAR named optimized-renderer-1.0.0.jar (URL also stored as chunked base64 decoding to cdn.discordapp.com/attachments/1507484731535785994/1540335670831222894/optimized-renderer-1.0.0.jar) into each discovered mods folder, delivering unverified code that will execute the next time the user launches Minecraft with a Fabric loader. The postinstall suppresses stderr and uses a 4-second setTimeout to appear to finish cleanly. Because validateSecret (part of the three-function public API) schedules _run() via setImmediate, the same theft and dropper also fire whenever a downstream consumer imports the package and calls the advertised TOTP function — extending the attack surface well beyond install time.

Source: amazon-inspector (8cebaa0a3370c12104ef2816420193171f431df0d113fdc5d8c9f1dc921deeb5)