MAL-2026-15857

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@quantixfinance/wallet/MAL-2026-15857.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-15857
Published
2026-09-03T15:51:31Z
Modified
2026-09-03T16:30:07.716036426Z
Summary
Malicious code in @quantixfinance/wallet (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (18cabdbe5d59eb5064ea44a0a73db01d23affa7975049251454f599210aa79e3)

The package advertises itself as a wallet library but ships a 67-byte no-op index.js; the entire payload is a preinstall lifecycle script that fires automatically on npm install. The script iterates process.env and selects variables whose names contain any of a broad credential-related substring list (key, secret, token, pass, mnemonic, seed, private, wallet, api, rpc, infura, alchemy, supabase, database, deploy, vercel, railway, tron, contract, env, url), then bundles the matched values together with the machine hostname, current working directory, and Node.js version and POSTs the JSON to a hardcoded remote endpoint. The destination host is written as the 32-bit integer 759017974, which decodes to 45.61.177.246, and the request targets port 61289 with a per-victim GUID-shaped path. The integer-encoded host defeats plain-text URL scanning and there is no documented functionality that would justify the outbound POST.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-09-03T16:19:43.043435825Z",
            "id": "IN-MAL-2026-019367",
            "versions": [
                "1.0.0"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-09-03T15:51:31Z",
            "sha256": "18cabdbe5d59eb5064ea44a0a73db01d23affa7975049251454f599210aa79e3"
        }
    ]
}
References
Credits

Affected packages

npm / @quantixfinance/wallet

Package

Name
@quantixfinance/wallet
View open source insights on deps.dev
Purl
pkg:npm/%40quantixfinance/wallet

Affected ranges

Affected versions

1.*
1.0.0

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@quantixfinance/wallet/MAL-2026-15857.json"
indicators 
{
    "evidence_files": [
        {
            "path": "preinstall.js",
            "tlsh": "8e21ba4af5bcf3b641a252b450cbc021a97fa40323c189a76b7c41d5ff468dc65634bb",
            "sha256": "5ba35e7025a373dac1380e610b797be1612a10b86f792fe5118e4f25ee688686"
        }
    ],
    "package_integrity": [
        {
            "filename": "wallet-1.0.0.tgz",
            "hashes": {
                "sha1": "1627bf2f40148c3e60f72d92b5af138d1975913e",
                "sha512_sri": "sha512-fFLC7kXJBRk5ZDMd3l8jCOJxWGMKgx4jx65XPz/eE5HFCJLldB7jUcvPZF38Uo/7cUzwbAg0OraD6lxrhFAluA=="
            }
        }
    ]
}
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    }
]