vault-strategies@999.0.0
Malicious code in vault-strategies (npm)
T1195.002 · Compromise Software Supply ChainT1059.007 · JavaScriptT1082 · System Information DiscoveryT1552.001 · Credentials In FilesT1071.001 · Web ProtocolsT1041 · Exfiltration Over C2 Channel
Analysis
The preinstall hook executes postinstall.js, which collects system information (hostname, username, current working directory) and environment variables matching credential-related patterns (key, secret, token, pass, private, ssh, deploy, auth, api, rpc, wallet, sentry, docker, graph, slack, host). All harvested data is sent as a JSON POST request to 185[.]130[.]46[.]35:8443/collect over HTTPS. Runtime analysis confirmed the C2 beaconing to this endpoint.
- analyzed by
- Leitwacht
- first seen
- Jun 15, 2026, 03:43 PM
- analyzed
- Jun 15, 2026, 03:44 PM
Related advisories
- flow-lending-sdk@9.9.9
- bodega-sdk@9.9.9
- surf-lending@9.9.9
- flowdefi@9.9.9
- flowcardano@9.9.9
- flow-lending@9.9.9
- umi-preset-rce-jytest@1.0.1
- typescript-util-core@3.5.0
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.