registry / Credential exfiltration / totp-utils

totp-utils

Lightweight TOTP/HOTP token generation utilities — no dependencies, pure Node.js crypto

This report shows the evidence for totp-utils@1.4.9. 8 of 9 known versions are blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

This is concrete install-time credential exfiltration plus remote payload placement, unrelated to TOTP functionality. The benign API is a cover and also activates the malicious runner.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm postinstall or calling validateSecret

Impact

Credential theft and unconsented remote code payload placement in Minecraft mod directories.

Mechanism

harvests tokens, posts them to Discord, and installs a downloaded JAR

Attack narrative

During npm postinstall, the package delays execution and runs code that harvests Minecraft launcher, Modrinth, and Discord tokens. It validates Discord tokens against Discord's API and posts collected tokens to a Discord webhook. In parallel, it downloads a JAR from Discord's CDN and writes it to detected Minecraft mod directories. Calling the ostensibly benign validateSecret API schedules the same behavior.

AI rationale

This is concrete install-time credential exfiltration plus remote payload placement, unrelated to TOTP functionality. The benign API is a cover and also activates the malicious runner.

Evidence

package.jsonindex.js.minecraft/launcher_accounts.jsonModrinthApp/app.dbLocal Storage/leveldbmods/optimized-renderer-1.0.0.jar

Network endpoints2

discord.comcdn.discordapp.com

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

postinstall runs the entrypoint with --setup.
Setup delays then invokes the credential-stealing runner.
Runner harvests Minecraft and Discord tokens and exfiltrates them.
It downloads and writes a remote JAR into Minecraft mod folders.
Calling validateSecret also triggers the runner.

Evidence against

A small TOTP/HOTP API is present, but it does not limit the unrelated malicious behavior.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 14.5 KB of source, external domains: cdn.discord

Source & flagged code

9 flagged

package.jsonView file

•scripts.postinstall = node ./index.js --setup

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./index.js --setup

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

index.jsView file

•matchType = normalized_sha256 matchedPackage = totp-utils@1.4.8 matchedPath = index.js matchedIdentity = npm:dG90cC11dGlscw:1.4.8 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

index.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = f1fd3702acd9ebec signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = totp-utils@1.4.8 matchedPath = index.js matchedIdentity = npm:dG90cC11dGlscw:1.4.8 similarity = 1.000 shingleOverlap = 1 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

index.jsView on unpkg

3const path = require("path"); L4: const https = require("https"); L5: const http = require("http"); L6: const { createHmac, createDecipheriv } = require("crypto"); L7: const os = require("os"); ... L10: if ( L11: process.env.CI === "true" || process.env.CONTINUOUS_INTEGRATION === "true" || L12: process.env.npm[redacted] === "true" || process.env.JEST_WORKER_ID || ... L26: const _LA = process.env.LOCALAPPDATA || ""; L27: const _HM = process.env.USERPROFILE || os.homedir(); L28: ... L38: req.on("error", () => resolve(null));

Low

Weak Crypto

Package source references weak cryptographic algorithms.

index.jsView on unpkg · L3

index.js#virtual:normalized:round1View file

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

index.js#virtual:normalized:round1View on unpkg · L3

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

index.js#virtual:normalized:round1View on unpkg · L3

3Trigger-reachable chain: scripts.postinstall -> index.js L3: const path = require("path"); L4: const https = require("https"); L5: const http = require("http"); L6: const { createHmac, createDecipheriv } = require("crypto"); L7: const os = require("os"); ... L10: if ( L11: process.env.CI === "true" || process.env.CONTINUOUS_INTEGRATION === "true" || L12: process.env.npm[redacted] === "true" || process.env.JEST_WORKER_ID || ... L26: const _LA = process.env.LOCALAPPDATA || ""; L27: const _HM = process.env.USERPROFILE || os.homedir(); L28: ... L38: req.on("error", () => resolve(null));

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./index.js --setup

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./index.js --setup

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

index.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

index.jsView on unpkg

Findings

3 Critical4 High4 Medium5 Low

CriticalHardcoded Runtime Data Exfiltrationindex.js#virtual:normalized:round1

CriticalCredential Exfiltrationindex.js#virtual:normalized:round1

CriticalTrigger Reachable Dangerous Capabilityindex.js#virtual:normalized:round1

HighInstall Time Lifecycle Scriptspackage.json

HighTrigger Reachable Credential Exfiltrationindex.js#virtual:normalized:round1

HighKnown Malware Source Similarityindex.js

HighKnown Malware Source Fingerprint Signatureindex.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

Affected versions and remediation

This report applies to totp-utils@1.4.9.

The versions list below shows the verdict for each recorded version.

Avoid installing totp-utils@1.4.9. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-24 06:00:11.517Z (UTC).

Source advisory published: 2026-08-21 12:25:46.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

9 known versions

0.0.1-securitylatestClean—AllowPublishedAug 23, 2026, 4:46 PM 1.4.9shownMaliciousCredential ExfiltrationBlockPublishedAug 22, 2026, 7:35 PM 1.4.8MaliciousCredential ExfiltrationBlockPublishedAug 22, 2026, 7:24 PM 1.4.7MaliciousCredential ExfiltrationBlockPublishedAug 22, 2026, 7:20 PM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other credential exfiltration packages

Runtime surface

Behavioral surface

Related packages

Other credential exfiltration packages

Source & flagged code