Loading npm security reports…
Lightweight TOTP/HOTP token generation utilities — no dependencies, pure Node.js crypto
On npm install, the package harvests launcher and Discord/browser credentials, exfiltrates them, and drops a remotely downloaded JAR into detected Minecraft mod folders. Calling validateSecret also starts the same collector.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgpostinstall invokes index.js with --setup.
package.jsonView on unpkg · L6Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgSource decodes a Base64-obscured HTTP endpoint at runtime.
index.jsView on unpkg · L3It downloads and writes a JAR into Minecraft mod folders.
index.jsView on unpkg · L290Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L7Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L7postinstall invokes index.js with --setup.
package.jsonView on unpkg · L6Source decodes a Base64-obscured HTTP endpoint at runtime.
index.jsView on unpkg · L3It downloads and writes a JAR into Minecraft mod folders.
index.jsView on unpkg · L290