streamvault@1.0.1
Malicious code in streamvault (npm)
Analysis
streamvault@1.0.1 is a trojan logging library that depends on byteboxlab, which contains an RCE downloader. Upon loading the module, it fetches a second-stage payload from hxxps://axioshealthcheck[.]vercel[.]app/debugCheck?id=<DEBUG_value> via HTTPS POST. The response contains a base64-encoded JavaScript payload that is decoded and executed via new Function(code)(require), giving the attacker arbitrary code execution on the installed system. The downloader retries up to 10 times within a 60-second window. The package impersonates a real developer to appear legitimate.
- analyzed by
- Leitwacht
- first seen
- Jun 14, 2026, 07:48 AM
- analyzed
- Jun 14, 2026, 07:49 AM
Related advisories
- st-pathhelper@1.0.0
- stacknova@1.0.0
- sort-btree@2.1.4
- solana-token-api@1.0.0
- snavbox@1.0.1
- sjs-lint-build1@1.0.4
- sjs-builder@1.0.5
- simple-auth-basic@2.0.2
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.