Skip to content
supplychainattack.orgSupply chain attack incident catalog
containedcritical

Malicious code in boring-vault (npm)

boring-vault is a malicious npm package impersonating the BoringVault smart-contract framework. It executes install-time payloads that harvest environment variables, credential files, and SSH/cloud configuration data, exfiltrating them to an attacker-controlled webhook.

ShareXLinkedInHacker News
Disclosed
Last updated
Blast radius
Developers and organizations installing the malicious boring-vault package; exposed credentials and secrets from affected systems.
Ecosystems
npm
Attack vectors
TyposquattingCompromised package
Affected entities
  • boring-vault · 1.0.0, 1.1.0

boring-vault is a typosquatting attack targeting developers seeking the legitimate BoringVault smart-contract framework. The malicious package contains no functional code—only a package.json and an install-time payload (index.js) that executes via preinstall and postinstall hooks.

Version 1.0.0 harvests environment variables matching patterns like KEY, TOKEN, SECRET, PASS, PRIVATE, MNEMONIC, RPC, AWS, GITHUB, NPM, KUBE, VAULT, AUTH, PGP, GPG, SEED, and WALLET. It also collects the contents of ~/.npmrc and ~/.gitconfig, directory listings of ~/.ssh, ~/.foundry/keystores, ~/.config/hardhat, and ~/.config/gcloud, plus hostname, username, working directory, and platform information. All collected data is exfiltrated via HTTPS POST to https://webhook.site/326b0891-2093-4800-a4c1-686ce3e07b09.

Version 1.1.0, published approximately 2.5 hours after 1.0.0, escalates the attack by reading full file contents (up to 4000 bytes) instead of just directory listings. New targets include ~/.aws/credentials, ~/.aws/config, ~/.ssh/id_rsa, ~/.ssh/id_ed25519, ~/.ssh/config, ~/.kube/config, ~/.docker/config.json, ~/.netrc, ~/.pgpass, ~/.pypirc, ~/.git-credentials, and GCP credential files. Errors are silently swallowed to prevent visible installation failures.

Indicators of compromise

Packages
  • boring-vault
Domains
  • webhook.site

Remediation

  • Immediately uninstall boring-vault from all systems
  • Revoke or rotate all credentials and secrets that may have been exposed (AWS keys, GitHub tokens, NPM tokens, SSH keys, GCP credentials, Kubernetes configs, Docker configs, PGP/GPG keys, wallet seeds, mnemonics)
  • Audit npm install logs and package-lock.json files to identify affected systems and timelines
  • Review access logs for AWS, GitHub, GCP, and other cloud/SaaS platforms for unauthorized activity
  • If boring-vault was installed in a CI/CD environment, rotate all secrets used in that pipeline
  • Monitor the exfiltration endpoint (webhook.site/326b0891-2093-4800-a4c1-686ce3e07b09) for evidence of data collection
  • Implement npm package verification and allowlisting policies to prevent installation of typosquatting packages

Sources

  1. GitHub Advisory GHSA-2hm3-fxxw-fwgw · GitHub Advisory Database

Cite this entry

"Malicious code in boring-vault (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 12, 2026; last updated August 12, 2026. https://supplychainattack.org/incident/malicious-code-in-boring-vault-npm-1qksek

Suggest a correction

Found an error or have a newer source? Corrections to factual errors take priority over new entries.

Related incidents

  1. resolvedcritical

    Malicious code in typescirpt-cli (npm)

    The npm package typescirpt-cli (a typosquat of typescript-cli) contained malicious code in its postinstall script that downloads and executes a binary (main.exe) on Windows and WSL systems, and exfiltrates system metadata to a hardcoded IP address.

    npmTyposquattingCompromised package
  2. containedcritical

    Malicious code in typescipt-core (npm)

    The npm package typescipt-core (a typosquat of typescript) contained malicious postinstall code that downloads and executes a second-stage payload on Windows and WSL systems. The dropper exfiltrates host profile information to 193.70.34.101:20099 before fetching attacker-controlled executables.

    npmCompromised packageTyposquatting
  3. containedcritical

    Malicious code in typesript-cli (npm)

    The npm package 'typesript-cli' (a one-character typosquat of 'typescript') contains malicious code in its postinstall script that downloads and executes a Windows PE binary, and can cross the Linux/WSL sandbox boundary to execute payloads on the Windows host. The script also beacons to a hardcoded IP endpoint.

    npmTyposquattingCompromised package
  4. resolvedcritical

    Malicious code in typescirpt-core (npm)

    The npm package 'typescirpt-core' (a typosquat of 'typescript') contained malicious code that executed on install, downloading and executing a Windows executable and pivoting WSL environments back to the host Windows system.

    npmTyposquattingCompromised package