MAL-2026-15849

    Dashboard / Malicious Package / MAL-2026-15849

    MAL-2026-15849

    Published: 3 Sept 2026Last Modified: 3 Sept 2026

    Summary: Malicious code in @quantixfinance/common (npm)

    Details: Source: amazon-inspector (be7f05a2980d77035384d4d27df1058513e5cd1cff50fb5ce040e85986fe0231) The package's preinstall lifecycle script iterates process.env and collects any variable whose name matches a broad list of secret-shaped substrings (key, secret, token, pass, mnemonic, seed, private, wallet, api, rpc, infura, alchemy, database, supabase, vercel, railway, and others), bundles the matches with hostname, cwd, and Node version, and POSTs the JSON payload to a hardcoded destination written as the 32-bit integer 759017974 (decoding to 45.61.169.70) on port 61289. The numeric-integer form of the hostname evades trivial IP/URL string scanners. The behavior fires automatically on `npm install`, so any environment with wallet mnemonics, cloud credentials, or CI tokens in its environment will have those values shipped to the hardcoded endpoint before any package code is otherwise used.

    References: https://www.npmjs.com/package/@quantixfinance/common/v/1.0.0

    Affected packages

    Package

    Name: @quantixfinance/common

    Purl: pkg:npm/%40quantixfinance/common

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0