MAL-2026-15850

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@quantixfinance/config/MAL-2026-15850.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-15850
Published
2026-09-03T15:52:25Z
Modified
2026-09-03T16:30:07.118372786Z
Summary
Malicious code in @quantixfinance/config (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (3064c4e02a71b4d0369c649c6aafe3ed3ecde9e7d119e368b42dc7507ae2bb03)

The package's preinstall lifecycle script enumerates process.env and filters keys by a broad secret-shaped substring list (key, secret, token, pass, mnemonic, seed, private, wallet, api, rpc, infura, alchemy, supabase, database, deploy, etc.), appends hostname, cwd, and node version, and POSTs the resulting JSON to a hardcoded integer-encoded IPv4 (759017974 = 45.53.87.182) on port 61289. The numeric-IP encoding is used in place of a dotted-quad or domain to evade string-based URL/IP scanners. The main entry (index.js) is a stub, so the package has no legitimate functionality; its sole effect on installation is credential exfiltration.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-09-03T16:19:43.719223306Z",
            "id": "IN-MAL-2026-019373",
            "versions": [
                "1.0.0"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-09-03T15:52:25Z",
            "sha256": "3064c4e02a71b4d0369c649c6aafe3ed3ecde9e7d119e368b42dc7507ae2bb03"
        }
    ]
}
References
Credits

Affected packages

npm / @quantixfinance/config

Package

Name
@quantixfinance/config
View open source insights on deps.dev
Purl
pkg:npm/%40quantixfinance/config

Affected ranges

Affected versions

1.*
1.0.0

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@quantixfinance/config/MAL-2026-15850.json"
indicators 
{
    "evidence_files": [
        {
            "path": "preinstall.js",
            "tlsh": "8e21ba4af5bcf3b641a252b450cbc021a97fa40323c189a76b7c41d5ff468dc65634bb",
            "sha256": "5ba35e7025a373dac1380e610b797be1612a10b86f792fe5118e4f25ee688686"
        }
    ],
    "package_integrity": [
        {
            "filename": "config-1.0.0.tgz",
            "hashes": {
                "sha1": "b6107b093c598ccfbc81ebee20e21782ce3ef555",
                "sha512_sri": "sha512-Cv+nnECcr9lajYRDgwBE/TDo4kVdt9TNzmv12RquLAaJk4pR+yBWlRmq6q0owQlyHI5crs2F4F1pEb3ZtkWXFw=="
            }
        }
    ]
}
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    }
]