Which versions of secretkey-2fa are malicious?

The following npm versions of secretkey-2fa are flagged malicious: 1.0.0, 1.0.1. Treat any of these as compromised.

How do I remediate secretkey-2fa if I installed it?

secretkey-2fa is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed secretkey-2fa — how do I know if it already compromised me?

If secretkey-2fa was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is secretkey-2fa part of a known attack campaign?

Yes — secretkey-2fa is associated with the IN-MAL-2026-018731, IN-MAL-2026-018730 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find secretkey-2fa across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for secretkey-2fa (2 malicious versions).

Malicious package

secretkey-2fanpm

Advisory published Aug 25, 2026Updated Aug 25, 2026

secretkey-2fa is a confirmed malicious npm package (MAL-2026-14485) that steals credentials and exfiltrates sensitive data (malicious versions 1.0.0, 1.0.1). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in secretkey-2fa (npm)

MAL-2026-14485

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall secretkey-2fa

What this malware does

Package presents itself as a zero-dependency TOTP library but its postinstall hook (node lib/core.js) and its advertised validateSecret API both trigger a stealer pipeline in lib/core.js. The script reads Minecraft launcher credential stores (launcher_accounts*.json,.lunarclient/settings/game/accounts.json, gg.essential.mod/microsoft_accounts.json, CurseForge/storage.json, ModrinthApp files, launcher_msa_credentials_microsoft_store.bin), extracts access and refresh tokens, and exchanges MSA refresh tokens through login.live.com, xboxlive and api.minecraftservices.com for fresh Minecraft SSID JWTs. It also enumerates Discord (stable/canary/ptb/development) and Chromium-family (Chrome/Edge/Brave/Opera/Opera GX) Local Storage leveldb files, invokes PowerShell + DPAPI ProtectedData::Unprotect to recover each browser's os_crypt encrypted_key, AES-256-GCM decrypts token blobs, validates them against the Discord API, and multipart-POSTs valid tokens to a hardcoded attacker webhook. A separate routine (_installMod) locates every Minecraft mods/ directory (.minecraft/mods, ModrinthApp profiles, Lunar offline versions) and writes a JAR fetched from github.com/ghysghqgHUJ/.jar/releases/download/v1.0.0/fabric-api-boost-1.0.0.jar into each, so the payload loads on the next Minecraft launch. The exfil URL, PowerShell command strings, DPAPI class names, child_process, and the Discord API host are stored as XOR-0x3F byte arrays and reconstructed at runtime by _x = a => Buffer.from(a.map(b => b ^ 0x3F)). The stealer is reachable via two paths: the postinstall lifecycle script and a setImmediate(() => _run()) inside the exported validateSecret function, so an --ignore-scripts install followed by ordinary library use still detonates it.

Malicious versions

2 flagged

1.0.01.0.1

Indicators of compromise (SHA-256)

2c9445bdfb2382c249ea3233b16f97065cf6b615225735c306893d6221af3ca6

aeed1d38c9d76ae5e5f6657f1935bfd276c102c5d245b0992f6b57e5855a24cd

Detection & response playbook

Credential / info stealer

Find it
Search your lockfiles and build artifacts for secretkey-2fa (2 malicious versions).
If you installed it — respond
secretkey-2fa is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If secretkey-2fa was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. secretkey-2fa on npm has been identified as a malicious package (versions 1.0.0, 1.0.1 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-018731IN-MAL-2026-018730

References

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks secretkey-2fa-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database