Hostile 100% javascript Download

boring-vault 1.1.1

Credential stealer with OOB exfil

NPM victim identifiers with exfiltrationSends a serialized Node host profile through an HTTP POST
SHA-2562bd195586fe4ace906915f308a38007cdccf50e5669ee5e5bbc1b1db8df9a310
URLhttps://r.cnpmjs.org/boring-vault/-/boring-vault-1.1.1.tgz
MaleculeO₅(Ca₄Eu₄S₇ErDy₂)H₆(Cm₃CrDbF₃Os₄Po₅)Md₂(InPa₂)

Also flagged by osv (MAL-2026-13771: Malicious code in boring-vault (npm)) +2 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.