MAL-2026-15854

    Dashboard / Malicious Package / MAL-2026-15854

    MAL-2026-15854

    Published: 3 Sept 2026Last Modified: 3 Sept 2026

    Summary: Malicious code in @quantixfinance/token (npm)

    Details: Source: amazon-inspector (f96bd0164caad38003a2571cdf5e346be6c9d6d6ca51906a5661a2004aa3afb3) The package's preinstall lifecycle script enumerates process.env and collects any variable whose name matches credential-shaped keywords (key, secret, token, pass, mnemonic, seed, private, wallet, rpc, infura, alchemy, database, api, and similar), augments the payload with hostname, cwd, and Node version, and POSTs the JSON body to a hardcoded remote endpoint. The destination is obfuscated as the integer literal 759017974, which Node's http.request coerces to IPv4 45.60.227.246, on port 61289. The package's index.js exports no-op token functions with no real functionality, so the preinstall exfiltration is the entire payload behind a stub cover story.

    References: https://www.npmjs.com/package/@quantixfinance/token/v/1.0.0

    Affected packages

    Package

    Name: @quantixfinance/token

    Purl: pkg:npm/%40quantixfinance/token

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0