OpenSSF/OSV advisory MAL-2026-15850 confirms this npm version as malicious. The package's preinstall lifecycle script enumerates process.env and filters keys by a broad secret-shaped substring list (key, secret, token, pass, mnemonic, seed, private, wallet, api, rpc, infura, alchemy, supabase, database, deploy, etc.), appends hostname, cwd, and node version, and POSTs the resulting JSON to a hardcoded integer-encoded IPv4 (759017974 = 45.53.87.182) on port 61289...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in @quantixfinance/config (npm)
Details
The package's preinstall lifecycle script enumerates process.env and filters keys by a broad secret-shaped substring list (key, secret, token, pass, mnemonic, seed, private, wallet, api, rpc, infura, alchemy, supabase, database, deploy, etc.), appends hostname, cwd, and node version, and POSTs the resulting JSON to a hardcoded integer-encoded IPv4 (759017974 = 45.53.87.182) on port 61289. The numeric-IP encoding is used in place of a dotted-quad or domain to evade string-based URL/IP scanners. The main entry (index.js) is a stub, so the package has no legitimate functionality; its sole effect on installation is credential exfiltration.
Decision reason
OpenSSF Malicious Packages via OSV confirms @quantixfinance/config@1.0.0 as malicious (MAL-2026-15850): Malicious code in @quantixfinance/config (npm)