boring-vault @1.1.1

Summary

The package's preinstall and postinstall hooks execute index.js, which reads classic installer-secret paths (~/.aws/credentials, ~/.ssh/id_rsa, ~/.kube/config, ~/.docker/config.json, ~/.netrc, ~/.npmrc, ~/.foundry/keystores,.env files) and scrapes environment variables matching a broad credential regex (KEY|TOKEN|SECRET|PASS|PRIVATE|MNEMONIC|RPC|AWS|GITHUB|NPM|ANKR|...). The collected data is serialized and sent via a detached child process that sleeps 60-240 seconds before POSTing JSON to https://webhook.site/326b0891-2093-4800-a4c1-686ce3e07b09, a hardcoded non-first-party endpoint, so exfiltration outlives the install-time process. The script also contains sandbox-evasion checks that bail out on hostnames matching scan-/detonation/sandbox/ubuntu-fc-uvm, users named scan/nonroot/sandbox, environments containing honey/canarytokens strings, and npm mirror registries. The package name references an unrelated legitimate project; the shipped code is a credential stealer.

Source: amazon-inspector (42afd2d2d4bfb9b6b45e5aa124032b4314f394a73e5552851a4083f984dc5d21)