Loading npm security reports…

totp-utils@1.4.7: Malicious npm security report (Block) | LPM Firewall

registry / totp-utils / 1.4.7

totp-utils@1.4.7

Lightweight TOTP/HOTP token generation utilities — no dependencies, pure Node.js crypto

AI Security Review

scanned 3h ago · by lpm-firewall-ai

An npm postinstall harvests Minecraft and Discord credentials, exfiltrates them to an obfuscated webhook, and installs a downloaded JAR into Minecraft mod directories. Calling validateSecret also initiates the same routine.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm install; additionally, calling validateSecret after importing the package

Impact

Account-token theft and unconsented remote code/payload placement in user game directories.

Mechanism

credential theft, webhook exfiltration, and dropped JAR persistence

Attack narrative

During postinstall, the package delays execution, collects Minecraft and Discord tokens from local application data, validates Discord tokens with Discord's API, and posts results to an obfuscated webhook. It also downloads a JAR and writes it to detected Minecraft mod folders. The same execution is scheduled by the exported validateSecret function.

Rationale

The package's advertised TOTP code is coupled to concrete credential theft, remote exfiltration, and unsolicited payload installation. These behaviors execute automatically at install time and are unrelated to its stated purpose.

Evidence

package.jsonindex.jsAPPDATA/.minecraft/launcher_accounts.jsonAPPDATA/*/Local Storage/leveldbLOCALAPPDATA/Google/Chrome/User Data/Default/Local Storage/leveldbAPPDATA/.minecraft/mods/optimized-renderer-1.0.0.jar

Network endpoints

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./index.js --setup

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./index.js --setup

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

index.jsView file

3const path = require("path"); L4: const https = require("https"); L5: const http = require("http"); L6: const { createHmac, createDecipheriv } = require("crypto"); L7: const os = require("os"); ... L10: if ( L11: process.env.CI === "true" || process.env.CONTINUOUS_INTEGRATION === "true" || L12: process.env.npm[redacted] === "true" || process.env.JEST_WORKER_ID || ... L34: const _LA = process.env.LOCALAPPDATA || ""; L35: const _HM = process.env.USERPROFILE || os.homedir(); L36: ... L46: req.on("error", () => resolve(null));

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

index.jsView on unpkg · L3

•matchType = normalized_sha256 matchedPackage = totp-utils@1.4.6 matchedPath = index.js matchedIdentity = npm:dG90cC11dGlscw:1.4.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

index.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 4d15badccb763f70 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = totp-utils@1.4.6 matchedPath = index.js matchedIdentity = npm:dG90cC11dGlscw:1.4.6 similarity = 1.000 shingleOverlap = 1 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

index.jsView on unpkg

3const path = require("path"); L4: const https = require("https"); L5: const http = require("http"); L6: const { createHmac, createDecipheriv } = require("crypto"); L7: const os = require("os"); ... L10: if ( L11: process.env.CI === "true" || process.env.CONTINUOUS_INTEGRATION === "true" || L12: process.env.npm[redacted] === "true" || process.env.JEST_WORKER_ID || ... L34: const _LA = process.env.LOCALAPPDATA || ""; L35: const _HM = process.env.USERPROFILE || os.homedir(); L36: ... L46: req.on("error", () => resolve(null));

Low

Weak Crypto

Package source references weak cryptographic algorithms.

index.jsView on unpkg · L3