boring-vault@1.0.0

Analysis

The preinstall and postinstall hooks both run index.js, which harvests the installer's credentials and posts them to a remote endpoint. On install it scans every environment variable whose name matches KEY, TOKEN, SECRET, PASS, PRIVATE, MNEMONIC, RPC, AWS, GITHUB, NPM, KUBE, VAULT, AUTH, PGP, GPG, SEED or WALLET and captures their values; reads ~/.npmrc and ~/.gitconfig; and lists the contents of ~/.ssh, ~/.foundry/keystores, ~/.config/hardhat and ~/.config/gcloud. All of this (hostname, username, cwd, env secrets, npm/git config, wallet keystore and cloud credential directory listings) is POSTed as JSON to hxxps://webhook[.]site/326b0891-2093-4800-a4c1-686ce3e07b09. The hook swallows all errors so installs never fail. The package name mirrors the Boring Vault DeFi protocol and the payload specifically targets crypto wallet keystores and cloud/SSH credentials.