MAL-2026-15849

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@quantixfinance/common/MAL-2026-15849.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-15849
Published
2026-09-03T15:52:08Z
Modified
2026-09-03T16:30:07.120103286Z
Summary
Malicious code in @quantixfinance/common (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (be7f05a2980d77035384d4d27df1058513e5cd1cff50fb5ce040e85986fe0231)

The package's preinstall lifecycle script iterates process.env and collects any variable whose name matches a broad list of secret-shaped substrings (key, secret, token, pass, mnemonic, seed, private, wallet, api, rpc, infura, alchemy, database, supabase, vercel, railway, and others), bundles the matches with hostname, cwd, and Node version, and POSTs the JSON payload to a hardcoded destination written as the 32-bit integer 759017974 (decoding to 45.61.169.70) on port 61289. The numeric-integer form of the hostname evades trivial IP/URL string scanners. The behavior fires automatically on npm install, so any environment with wallet mnemonics, cloud credentials, or CI tokens in its environment will have those values shipped to the hardcoded endpoint before any package code is otherwise used.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-09-03T16:19:43.479816703Z",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ],
            "id": "IN-MAL-2026-019371",
            "modified_time": "2026-09-03T15:52:08Z",
            "sha256": "be7f05a2980d77035384d4d27df1058513e5cd1cff50fb5ce040e85986fe0231"
        }
    ]
}
References
Credits

Affected packages

npm / @quantixfinance/common

Package

Name
@quantixfinance/common
View open source insights on deps.dev
Purl
pkg:npm/%40quantixfinance/common

Affected ranges

Affected versions

1.*
1.0.0

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@quantixfinance/common/MAL-2026-15849.json"
indicators 
{
    "evidence_files": [
        {
            "path": "preinstall.js",
            "tlsh": "8e21ba4af5bcf3b641a252b450cbc021a97fa40323c189a76b7c41d5ff468dc65634bb",
            "sha256": "5ba35e7025a373dac1380e610b797be1612a10b86f792fe5118e4f25ee688686"
        }
    ],
    "package_integrity": [
        {
            "filename": "common-1.0.0.tgz",
            "hashes": {
                "sha512_sri": "sha512-KItnon5y0pA4e0cT3qAo7wWZGSLbVXM0MCA5BS6XFMBo2T13LAzHM76/9d/iZlCzIYhyFownt8WD0nmGZCWu/A==",
                "sha1": "ebde8848e1a0eaa1c8720283b050982677178d96"
            }
        }
    ]
}
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    }
]