There are some explanations on what YubiKey does here.
Basically, the password which the YubiKey "types" (from the
point of view of the computer, it is a keyboard) can be either a
static password, or a one-time password. If it is a static
password, then you just revealed it, and it is time to be very
sorry (and promptly change that password). The one-time
passwords, what YubiKey produces follows HOTP. The cryptography
in HOTP is such that it is not computationally feasible to
recompute the "master secret" from one or several one-time
passwords produced with HOTP. Moreover, each password is
internally computed from a counter. The YubiKey and the server
both maintain the same counter, and the server allows for some
limited lack of synchronization. Namely, when the server's
current counter has value n and receives a password as
authentication attempt, it will internally generate the
passwords for values n+1, n+2,... up to, say, n+100 (that's
configurable). If a match is found with (say) password n+17,
then acces