MAL-2026-15852

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@quantixfinance/sdk/MAL-2026-15852.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-15852
Published
2026-09-03T15:51:55Z
Modified
2026-09-03T16:30:07.318318553Z
Summary
Malicious code in @quantixfinance/sdk (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (f2fde29a3682637d696a6bb2614ba4ddf9b7f2b99c3d3a65380ced1ce3d7f57a)

@quantixfinance/sdk@1.0.0 ships an inert library body (index.js exports an empty QuantixSDK class and a createClient stub) while its preinstall lifecycle script performs credential harvesting. On npm install, the preinstall code iterates process.env and collects every variable whose name matches credential-related keywords (key, secret, token, pass, mnemonic, seed, private, wallet, rpc, infura, alchemy, supabase, database, api, deploy, env) along with hostname, cwd, and node version, then POSTs the collected JSON to a hardcoded IPv4 host encoded as an integer literal (759017974, resolving to 45.61.169.150) on port 61289 at path /0471e9cef36a6718b0f2bfdbec06bd82/47acfe667ff0162697f4af03/54c960d45ce346f9/r. Encoding the destination as an integer rather than a dotted-quad or domain evades string/URL scanners. The package's only functional behavior is this exfiltration; the advertised SDK is a decoy.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-09-03T16:19:43.379413198Z",
            "id": "IN-MAL-2026-019370",
            "versions": [
                "1.0.0"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-09-03T15:51:55Z",
            "sha256": "f2fde29a3682637d696a6bb2614ba4ddf9b7f2b99c3d3a65380ced1ce3d7f57a"
        }
    ]
}
References
Credits

Affected packages

npm / @quantixfinance/sdk

Package

Name
@quantixfinance/sdk
View open source insights on deps.dev
Purl
pkg:npm/%40quantixfinance/sdk

Affected ranges

Affected versions

1.*
1.0.0

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@quantixfinance/sdk/MAL-2026-15852.json"
indicators 
{
    "evidence_files": [
        {
            "path": "preinstall.js",
            "tlsh": "8e21ba4af5bcf3b641a252b450cbc021a97fa40323c189a76b7c41d5ff468dc65634bb",
            "sha256": "5ba35e7025a373dac1380e610b797be1612a10b86f792fe5118e4f25ee688686"
        },
        {
            "path": "index.js",
            "tlsh": "56a022c222b8e2f832fa8083c008cc8233c0f0c0a28ce0fa028cb2acc808c88032800c",
            "sha256": "f115c8f0eb9b86b5f57059337c78cfaa68992877f09aff402665706de2bfbc36"
        }
    ],
    "package_integrity": [
        {
            "filename": "sdk-1.0.0.tgz",
            "hashes": {
                "sha1": "ec5ce06d089d598cb564d77408d285b991041475",
                "sha512_sri": "sha512-g0tu+E73h24JaP+kGRBhiysKTjih5q62RhnIaD2OIOaj0stt3hRiBWnMQaKWzrPo3qFfkOXvDWJZw0kSjezgMg=="
            }
        }
    ]
}
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    }
]