Malicious code in totp-utils (npm)
The npm package totp-utils contained malicious code that harvested Discord authentication tokens, Minecraft launcher credentials, and injected a malicious JAR into Minecraft mod directories via a postinstall script and exported API function.
- Disclosed
- Last updated
- Blast radius
- Users who installed affected versions of totp-utils; secondary impact to Minecraft users via malicious JAR injection
- Ecosystems
- Attack vectors
- Affected entities
- totp-utilsnpm package containing malicious postinstall script and validateSecret API
The totp-utils npm package was found to contain malicious code disguised as a TOTP utility. The package's postinstall script and exported validateSecret API both invoked a hidden _run() routine that performed credential harvesting and code injection attacks.
The malicious code targeted Discord authentication tokens by scanning LevelDB stores in Chrome, Edge, Brave, and Opera browsers, then decrypting them using Windows DPAPI via PowerShell. It also harvested Minecraft launcher credentials from vanilla, Lunar, and Modrinth launcher configuration files. Harvested Discord tokens were validated against the Discord API and exfiltrated to a hardcoded Discord webhook endpoint.
Additionally, the malicious code enumerated Minecraft mod directories and injected an opaque JAR file (optimized-renderer-1.0.0.jar) downloaded from a Discord CDN URL into each discovered mods folder. This JAR would execute when users launched Minecraft with a Fabric loader, delivering unverified code to affected systems.
The postinstall script suppressed error output and used a 4-second delay to appear to complete cleanly, masking the malicious activity from users.
Indicators of compromise
- Packages
- totp-utils
- Domains
- discord.com
- cdn.discordapp.com
- Hashes
- 8cebaa0a3370c12104ef2816420193171f431df0d113fdc5d8c9f1dc921deeb5
Remediation
- Immediately uninstall totp-utils from all systems
- Audit npm package.json and lock files for totp-utils presence
- Rotate Discord authentication tokens if installed on systems with Discord
- Scan Minecraft mod directories for the presence of optimized-renderer-1.0.0.jar and remove if found
- Review browser credential stores for unauthorized access
- Consider using alternative TOTP libraries from trusted maintainers
- Implement package integrity verification and supply chain security scanning in CI/CD pipelines
Sources
- GitHub Advisory GHSA-93j4-gp34-3h5m · GitHub Advisory Database
Cite this entry
"Malicious code in totp-utils (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 23, 2026; last updated August 23, 2026. https://supplychainattack.org/incident/malicious-code-in-totp-utils-npm-1km2co
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malware in svelte-dim-kit
The npm package svelte-dim-kit was found to contain malware, potentially giving attackers full control of affected systems. All systems with this package installed should be considered compromised and secrets/keys rotated immediately from a different computer.
npmCompromised package - containedcritical
Malicious code in @syncraft-labs/react (npm)
The npm package @syncraft-labs/react contained obfuscated malicious code in its ESM distribution that implements the EtherHiding pattern, fetching and executing arbitrary code from an Ethereum smart contract via RPC endpoints. The tampering occurred post-build in the dist/index.js artifact.
npmCompromised package - containedcritical
Malicious code in stillm4ddpocs-demo-sprocket (npm)
The npm package stillm4ddpocs-demo-sprocket version 999.9.12 contains malicious code that exfiltrates system and project metadata via multiple channels (HTTPS, HTTP, and DNS) to a hardcoded callback host. The package uses a high version number to exploit dependency-confusion attacks against organizations with internal packages of the same name.
npmCompromised packageDependency confusion - resolvedcritical
Malicious code in stillm4ddpocs-rtest-bravo (npm)
The npm package stillm4ddpocs-rtest-bravo contained malicious code in its preinstall script that automatically executed during installation, collecting system information and internal package metadata and exfiltrating it to a third-party Interactsh collector via HTTPS and DNS tunneling.
npmCompromised package