secret-key-totp@1.5.1

secret-key-totp@1.5.1 declares a postinstall hook (`node./index.js --setup`) that executes a credential stealer and dropper on install, and the same routine also fires when the library API (e.g. `validateSecret`) is called. The stealer walks Minecraft launcher account stores (vanilla `launcher_accounts*.json`, Lunar, Essential, CurseForge, Modrinth) and Discord/Chromium browser Local Storage (Discord, Chrome, Edge, Brave, Opera leveldb), decrypting Windows DPAPI+AES-GCM protected material, then POSTs the harvested tokens to a hardcoded Discord webhook whose URL is assembled from split string fragments (`["https://dis","cord.com/api/","webhooks/153242923376",...].join("")`). A second stage fetches an unpinned binary from a Discord CDN attachment URL (also string-split obfuscated) and writes it as `optimized-renderer-1.0.0.jar` into every discovered Minecraft mods folder (vanilla `.minecraft/mods`, Modrinth profile mods dirs, Lunar offline versions), providing persistence and further code execution inside the Minecraft process on next launch. Sandbox/CI evasion (`_isSandbox` checks `CI`, `npm_config_global`, `JEST_WORKER_ID`, `npm_lifecycle_script` containing `audit`/`pack`, and missing `USERPROFILE`/`APPDATA`/`Documents`) plus a 3-6 second randomized delay are used to make `npm install` appear clean.