MAL-2026-15854

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@quantixfinance/token/MAL-2026-15854.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-15854
Published
2026-09-03T15:51:24Z
Modified
2026-09-03T16:30:07.582212580Z
Summary
Malicious code in @quantixfinance/token (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (f96bd0164caad38003a2571cdf5e346be6c9d6d6ca51906a5661a2004aa3afb3)

The package's preinstall lifecycle script enumerates process.env and collects any variable whose name matches credential-shaped keywords (key, secret, token, pass, mnemonic, seed, private, wallet, rpc, infura, alchemy, database, api, and similar), augments the payload with hostname, cwd, and Node version, and POSTs the JSON body to a hardcoded remote endpoint. The destination is obfuscated as the integer literal 759017974, which Node's http.request coerces to IPv4 45.60.227.246, on port 61289. The package's index.js exports no-op token functions with no real functionality, so the preinstall exfiltration is the entire payload behind a stub cover story.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-09-03T16:19:42.939543465Z",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ],
            "id": "IN-MAL-2026-019366",
            "modified_time": "2026-09-03T15:51:24Z",
            "sha256": "f96bd0164caad38003a2571cdf5e346be6c9d6d6ca51906a5661a2004aa3afb3"
        }
    ]
}
References
Credits

Affected packages

npm / @quantixfinance/token

Package

Name
@quantixfinance/token
View open source insights on deps.dev
Purl
pkg:npm/%40quantixfinance/token

Affected ranges

Affected versions

1.*
1.0.0

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@quantixfinance/token/MAL-2026-15854.json"
indicators 
{
    "evidence_files": [
        {
            "path": "preinstall.js",
            "tlsh": "8e21ba4af5bcf3b641a252b450cbc021a97fa40323c189a76b7c41d5ff468dc65634bb",
            "sha256": "5ba35e7025a373dac1380e610b797be1612a10b86f792fe5118e4f25ee688686"
        }
    ],
    "package_integrity": [
        {
            "filename": "token-1.0.0.tgz",
            "hashes": {
                "sha1": "5f9a4c06c605c7da1fe4575abdddd436b3293789",
                "sha512_sri": "sha512-h91mcVOVmXL4+f7IRZ4hm1h9aYJCaUVmmPunFuvm8dXxdYxoBJKyVc56V+tNldCgOoWSXcJ8V/3k0WQDJuSgdw=="
            }
        }
    ]
}
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    }
]