2fasecretkey@1.1.2

Analysis

The postinstall hook of this package downloads a JavaScript payload from hxxp://185[.]14[.]92[.]233:7777/p[.]js and executes it on the installer's machine. It writes the fetched payload to a random temp file (_vc<random>.js), creates a VBS launcher (_r.vbs) that invokes wscript.exe to run the payload hidden and detached, and spawns it with the node executable path and payload path passed via environment variables. The package is advertised as a two-factor-authentication helper but performs this remote code download-and-execute at install time.