Malicious code in vault-strategies (npm)

The 'vault-strategies' npm package version 999.0.0 includes a preinstall hook executing 'postinstall.js', which enumerates environment variables filtering keys with broad credential-related patterns (e.g., key, secret, token, pass, private, ssh, deploy, auth, api, rpc, wallet, sentry, docker, graph, slack, host). It collects these values along with hostname, username, current working directory, and npm configuration, then sends the aggregated data via HTTPS POST to the hardcoded IP address 185.130.46.35 on port 8443 at the '/collect' endpoint. The script suppresses errors to avoid detection. This behavior aligns with a canonical dependency confusion attack, where a malicious package mimics an internal package to steal credentials during installation.

Sensitive environment variables and system information can be exfiltrated silently during package installation, potentially leading to credential compromise and unauthorized access to systems or services that rely on these secrets. The malicious payload is triggered automatically on 'npm install' without user interaction beyond installing the package.

No official patch or remediation is currently documented. Users should avoid installing the 'vault-strategies' package version 999.0.0 from untrusted sources. Verify package authenticity and source before installation, especially for packages that appear to be internal or private. Monitor for suspicious network activity to the IP address 185.130.46.35 and consider blocking it at network perimeter controls. Remove the malicious package if already installed and rotate any potentially exposed credentials.