OpenSSF/OSV advisory MAL-2026-15849 confirms this npm version as malicious. The package's preinstall lifecycle script iterates process.env and collects any variable whose name matches a broad list of secret-shaped substrings (key, secret, token, pass, mnemonic, seed, private, wallet, api, rpc, infura, alchemy, database, supabase, vercel, railway, and others), bundles the matches with hostname, cwd, and Node version, and POSTs the JSON payload to a hardcoded destination written as the 32-bit...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in @quantixfinance/common (npm)
Details
The package's preinstall lifecycle script iterates process.env and collects any variable whose name matches a broad list of secret-shaped substrings (key, secret, token, pass, mnemonic, seed, private, wallet, api, rpc, infura, alchemy, database, supabase, vercel, railway, and others), bundles the matches with hostname, cwd, and Node version, and POSTs the JSON payload to a hardcoded destination written as the 32-bit integer 759017974 (decoding to 45.61.169.70) on port 61289. The numeric-integer form of the hostname evades trivial IP/URL string scanners. The behavior fires automatically on `npm install`, so any environment with wallet mnemonics, cloud credentials, or CI tokens in its environment will have those values shipped to the hardcoded endpoint before any package code is otherwise used.
Decision reason
OpenSSF Malicious Packages via OSV confirms @quantixfinance/common@1.0.0 as malicious (MAL-2026-15849): Malicious code in @quantixfinance/common (npm)