Malicious code in vaults-monitor-cron (npm)

The 'vaults-monitor-cron' npm package at version 999.0.0 contains malicious code executed during the preinstall lifecycle hook. The script collects hostname, username, current working directory, and environment variables matching patterns related to secrets and credentials (e.g., keys, tokens, passwords, SSH keys). It then exfiltrates this information as a JSON payload via HTTPS POST to a hardcoded IP address (185.130.46.35:8443/collect). The package employs a dependency confusion attack pattern by using a high version number and a generic description to override an organization's internal package silently. The preinstall command includes '|| true' to suppress errors and avoid detection. No legitimate functionality exists in this package; its sole effect is credential exfiltration.

This malicious package can lead to the theft of sensitive credentials such as CI tokens, SSH keys, deploy credentials, cloud API keys, RPC/wallet secrets, and other authentication tokens from the environment of the system where it is installed. This can result in unauthorized access to internal systems, cloud resources, and other critical infrastructure if these credentials are used elsewhere. The attack is silent due to error suppression, increasing the risk of unnoticed compromise.

No official patch or fix is available as this is a malicious package rather than a vulnerability in legitimate software. The recommended mitigation is to avoid installing this package and audit package dependencies to ensure only trusted sources are used. Organizations should implement strict package source controls and monitor for dependency confusion attacks. Remove any instances of 'vaults-monitor-cron' version 999.0.0 from projects and registries. Rotate any potentially exposed credentials immediately if this package was installed.