vaults-monitor-cron@999.0.0

Analysis

vaults-monitor-cron@999.0.0 is a dependency-confusion credential harvester. On npm install, the preinstall hook runs postinstall.js, which collects environment variables matching secret/credential patterns (key, token, pass, private, ssh, deploy, auth, api, rpc, wallet, sentry, docker, slack, host) — including NPM_TOKEN, GITHUB_TOKEN, SSH keys, AWS credentials, and wallet secrets — along with hostname, username, and working directory. The collected data is POSTed to hxxps://185[.]130[.]46[.]35:8443/collect. The hook uses "|| true" to mask failures, making installation appear successful. The package has no legitimate functionality (index.js exports an empty object).