QUIETVAULT
QUIETVAULT is a JavaScript-based credential stealer observed in active operations and in a supply-chain compromise involving trojanized npm packages. It targets GitHub and NPM tokens, including GitHub Personal Access Tokens, and has also been reported to collect environment variables, system information, and other sensitive configuration data. A distinctive capability is its abuse of AI tooling already present on the victim host: it checks compromised macOS and Linux systems for locally installed AI command-line tools such as Gemini CLI or Claude Code, then executes predefined natural-language prompts to recursively search for configuration files, wallet-related files, private keys, SSH configurations, cloud credentials, and other potential secrets. Captured data is exfiltrated by creating or publishing to publicly accessible GitHub repositories controlled by the attacker. QUIETVAULT has been linked in reporting to the August 2025 nx npm supply-chain compromise, where a postinstall script launched the stealer, and stolen GitHub credentials were later leveraged by UNC6426 for follow-on cloud compromise. High-confidence behaviors described in the source material include harvesting GitHub/NPM tokens, searching infected systems via local AI CLIs for additional secrets, collecting environment variables and system information, and exfiltrating stolen data to public GitHub repositories.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The packages were found to embed a postinstall script that, in turn, launched a JavaScript credential stealer named QUIETVAULT to siphon environment variables, system information, and valuable tokens, including GitHub Personal Access Tokens (PATs), by weaponizing a Large Language Model (LLM) tool already installed on the endpoint to perform the search.
Techniques & procedures
14 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
4 techniques
Initial Access
obtenir un accès initial aux environnements SaaS ... il est essentiel de se concentrer sur le renforcement des contrôles d'identité et de passer à une vérification continue de l'identité
Mandiant investigated a supply chain compromise involving the QUIETVAULT credential stealer...
Execution
1 technique
Execution
"Large language models are allowing hackers to generate, modify and execute commands on demand..."; "PromptSteal... queries a hosted model for one-line Windows commands that it runs locally"; "QuietVault, a JavaScript-based credential stealer"; "AI-generated ransomware scripts... using model-generated Lua"
Persistence
2 techniques
Persistence
Privilege Escalation
1 technique
Privilege Escalation
Stealth
1 technique
Stealth
Defense Impairment
1 technique
Defense Impairment
Credential Access
3 techniques
Credential Access
QUIETVAULT is a credential-theft variant. The JavaScript stealer exfiltrates GitHub and NPM tokens to an attacker-controlled GitHub repo...
Discovery
1 technique
Discovery
Lateral Movement
1 technique
Lateral Movement
Collection
1 technique
Collection
Recent activity
21 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
JavaScript credential stealer that exfiltrates GitHub and NPM tokens and leverages whatever AI CLI is installed on the victim to search for additional secrets.
Credential stealer observed checking compromised machines for AI command-line tools and using predefined prompts to locate configuration files and steal GitHub and NPM tokens.
Credential stealer observed searching compromised machines for command-line AI tools, then using predefined prompts to locate configuration files and collect GitHub and NPM tokens.
Credential stealer observed checking compromised machines for AI command-line tools and using predefined prompts to search for configuration files and collect GitHub and NPM tokens.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.