MalwarePublished 11 Aug 2026Updated 12 Aug 2026

boring-vault (npm) · Malicious Code

Affects boring-vaultSource GCVE Database

Malicious package : remove boring-vault and rotate any secrets on hosts that installed it.

Data as of 12 Aug 2026, 16:52 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13771

What to do

Remove boring-vault from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmboring-vault	Affected =1.1.1 =1.1.0 =1.0.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The boring-vault npm package is a malicious package impersonating the legitimate BoringVault smart-contract framework. It contains no legitimate functionality and executes a payload during installation that harvests sensitive environment variables, configuration files, and cryptocurrency wallet keys. The stolen data is exfiltrated to a hardcoded external endpoint. Two versions (1.0.0 and 1.1.0) exist, with 1.1.0 expanding the scope of stolen files and credentials. The package uses sandbox evasion techniques and disguises itself with a fake comment in version 1.0.0. Multiple related malicious packages from the same attacker account have been identified. Any environment that installed these versions should consider secrets compromised and rotate them immediately.

Impact

Installation of either version 1.0.0 or 1.1.0 of the boring-vault package results in exfiltration of sensitive environment variables, credential files, configuration files, and private keys, including cryptocurrency wallet keys. This compromises the confidentiality of secrets, potentially allowing attackers to access cloud services, source code repositories, cryptocurrency wallets, and other sensitive resources. The attacker can use stolen credentials for unauthorized access, financial theft, or further compromise. The malicious code executes silently during installation, making detection difficult. The expanded data theft in version 1.1.0 increases the severity of compromise.

Defensive guidance

The vendor does not manage this package as it is malicious. Environments that installed versions 1.0.0, 1.1.0, or 1.1.1 should immediately rotate all exposed secrets, prioritizing wallet private keys and RPC/API tokens. Treat all harvested credentials as compromised. Remove the malicious package from all systems. Audit for any unauthorized access or suspicious activity resulting from the compromise. Avoid installing packages from untrusted or unknown sources and verify package authenticity before installation.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 12 Aug 2026, 16:52 UTC

Technical details

References

Community reviews