MAL-2026-15852

    Dashboard / Malicious Package / MAL-2026-15852

    MAL-2026-15852

    Published: 3 Sept 2026Last Modified: 3 Sept 2026

    Summary: Malicious code in @quantixfinance/sdk (npm)

    Details: Source: amazon-inspector (f2fde29a3682637d696a6bb2614ba4ddf9b7f2b99c3d3a65380ced1ce3d7f57a) @quantixfinance/[email protected] ships an inert library body (index.js exports an empty QuantixSDK class and a createClient stub) while its preinstall lifecycle script performs credential harvesting. On npm install, the preinstall code iterates process.env and collects every variable whose name matches credential-related keywords (key, secret, token, pass, mnemonic, seed, private, wallet, rpc, infura, alchemy, supabase, database, api, deploy, env) along with hostname, cwd, and node version, then POSTs the collected JSON to a hardcoded IPv4 host encoded as an integer literal (759017974, resolving to 45.61.169.150) on port 61289 at path /0471e9cef36a6718b0f2bfdbec06bd82/47acfe667ff0162697f4af03/54c960d45ce346f9/r. Encoding the destination as an integer rather than a dotted-quad or domain evades string/URL scanners. The package's only functional behavior is this exfiltration; the advertised SDK is a decoy.

    References: https://www.npmjs.com/package/@quantixfinance/sdk/v/1.0.0

    Affected packages

    Package

    Name: @quantixfinance/sdk

    Purl: pkg:npm/%40quantixfinance/sdk

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0