MAL-2026-15548

    Dashboard / Malicious Package / MAL-2026-15548

    MAL-2026-15548

    Published: 29 Aug 2026Last Modified: 29 Aug 2026

    Summary: Malicious code in 2fasecretkey (npm)

    Details: Source: amazon-inspector (776f74322ea1fc554c37d759c1a038d8647779b1e2b3ce51e3fd4c865118e094) On npm install, the package's postinstall script performs an HTTP GET to http://185.14.92.233:7777/p.js, writes the response to a temp file, and launches it through a detached wscript.exe invocation of a VBS stager that runs the installer's Node executable against the downloaded payload with the window hidden (WScript.Shell.Run flag 0, detached, stdio ignored). The fetch uses plain HTTP against a hardcoded bare IP with no version pinning, hash check, or signature verification, and the executed code is not shipped in the tarball. The package's advertised purpose is a TOTP helper, which has no functional need to fetch or execute remote code at install time. The hidden-window VBS launcher conceals execution from the installing user.

    References: https://www.npmjs.com/package/2fasecretkey/v/1.1.4, https://www.npmjs.com/package/2fasecretkey/v/1.1.3, https://www.npmjs.com/package/2fasecretkey/v/1.1.2

    Affected packages

    Package

    Name: 2fasecretkey

    Purl: pkg:npm/2fasecretkey

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.1.4
    1.1.3
    1.1.2
    MAL-2026-15548 | CVE-DB