The boring-vault npm package is a malicious package that impersonates the BoringVault smart-contract framework but contains no legitimate code. Its install-time payload (index.js) executes automatically via preinstall and postinstall hooks. Version 1.0.0 harvests environment variables matching a broad credential regex, reads certain configuration files and directory listings related to credentials and keys, and exfiltrates this data via HTTPS POST to a hardcoded webhook.site URL. Version 1.1.0, published shortly after 1.0.0, expands the harvested data to include full contents of many sensitive credential files (e.g., AWS credentials, SSH private keys, Kubernetes config, Docker config, .netrc, .pgpass, GCP credentials), local .env files, and cryptocurrency wallet keys from multiple blockchain wallets. Both versions exfiltrate to the same external endpoint. The package includes sandbox evasion checks to avoid detection in analysis environments. The attacker account published multiple sibling malicious packages with similar behavior. The package name and initial comment attempt to impersonate legitimate projects. This threat represents a credential and key theft malware embedded in an npm package.

Installation of either version 1.0.0 or 1.1.0 of the boring-vault package results in exfiltration of sensitive environment variables, credential files, configuration files, and private keys, including cryptocurrency wallet keys. This compromises the confidentiality of secrets, potentially allowing attackers to access cloud services, source code repositories, cryptocurrency wallets, and other sensitive resources. The attacker can use stolen credentials for unauthorized access, financial theft, or further compromise. The malicious code executes silently during installation, making detection difficult. The expanded data theft in version 1.1.0 increases the severity of compromise.

No official patch or remediation is available for the malicious boring-vault package itself. The vendor does not manage this package as it is malicious. Environments that installed versions 1.0.0, 1.1.0, or 1.1.1 should immediately rotate all exposed secrets, prioritizing wallet private keys and RPC/API tokens. Treat all harvested credentials as compromised. Remove the malicious package from all systems. Audit for any unauthorized access or suspicious activity resulting from the compromise. Avoid installing packages from untrusted or unknown sources and verify package authenticity before installation.