MAL-2026-15848

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@quantixfinance/api/MAL-2026-15848.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-15848
Published
2026-09-03T15:51:07Z
Modified
2026-09-03T16:30:07.063139041Z
Summary
Malicious code in @quantixfinance/api (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (574ee760d08ba89b3c9a06d87af077eac7166d12ed8a98b00a30298c0236b6e7)

The package's preinstall lifecycle script runs automatically on npm install. It iterates process.env and collects every variable whose name contains credential-shaped substrings (key, secret, token, pass, mnemonic, seed, private, wallet, rpc, infura, alchemy, supabase, vercel, railway, api, env, url, database, contract, tron, deploy), along with hostname, cwd, and Node version, and POSTs the JSON payload via http.request to a hardcoded destination whose hostname is encoded as the bare integer 759017974 (decoding to IP 45.55.109.86) on port 61289, under a long random path. Errors are silently swallowed. The advertised main entry index.js is a stub exporting empty get/post/put/delete no-ops, so the manifest plus preinstall is the entire payload; the package presents as an API client while its only real behavior is install-time credential theft.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-09-03T16:19:42.702894715Z",
            "id": "IN-MAL-2026-019364",
            "versions": [
                "1.0.0"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-09-03T15:51:07Z",
            "sha256": "574ee760d08ba89b3c9a06d87af077eac7166d12ed8a98b00a30298c0236b6e7"
        }
    ]
}
References
Credits

Affected packages

npm / @quantixfinance/api

Package

Name
@quantixfinance/api
View open source insights on deps.dev
Purl
pkg:npm/%40quantixfinance/api

Affected ranges

Affected versions

1.*
1.0.0

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@quantixfinance/api/MAL-2026-15848.json"
indicators 
{
    "evidence_files": [
        {
            "path": "preinstall.js",
            "tlsh": "8e21ba4af5bcf3b641a252b450cbc021a97fa40323c189a76b7c41d5ff468dc65634bb",
            "sha256": "5ba35e7025a373dac1380e610b797be1612a10b86f792fe5118e4f25ee688686"
        }
    ],
    "package_integrity": [
        {
            "filename": "api-1.0.0.tgz",
            "hashes": {
                "sha512_sri": "sha512-Lo0MwXSEe3qsth/JNjr6l+Ic3PTSmYrC2smqwCUwg71t2HHGpLrH0ewxmxWMjjaGBan0nVaMAVA2VTKSl8bYgQ==",
                "sha1": "cd460c1d0966c79495bab38a1e851c516582d963"
            }
        }
    ]
}
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    }
]