The 'ethereum-vault-connector' npm package versions 1.0.0, 1.1.0, and 1.1.1 contains a malicious Node.js script acting as a credential stealer. This script runs automatically during the preinstall and postinstall lifecycle hooks, scanning environment variables for sensitive keys and reading common credential files such as AWS credentials, SSH keys, Kubernetes configs, Docker configs, npm and git credentials, and various blockchain-related key stores. It exfiltrates collected data via a delayed POST request to a specified webhook URL. The malware includes sandbox evasion logic that detects analysis environments by checking hostnames, usernames, environment markers, and npm registry mirrors, and aborts execution if such conditions are met, confirming its hostile intent.

Compromise of sensitive credentials and private keys stored in environment variables and common credential files on the victim's system. This can lead to unauthorized access to cloud services, version control systems, cryptocurrency wallets, and other critical resources. The malicious code executes automatically during package installation, increasing the risk of unnoticed credential theft.

No official patch or remediation is provided in the available data. Users should avoid installing the affected versions (=1.0.0, =1.1.0, =1.1.1) of the 'ethereum-vault-connector' package. Verify package authenticity before installation and prefer packages from trusted sources. Monitor for suspicious network activity related to credential exfiltration. Check vendor advisories or npm security advisories for updates or removal of the malicious package.