MAL-2026-15848 Malicious code in @quantixfinance/api (npm)

The package's preinstall lifecycle script runs automatically on npm install. It iterates process.env and collects every variable whose name contains credential-shaped substrings (key, secret, token, pass, mnemonic, seed, private, wallet, rpc, infura, alchemy, supabase, vercel, railway, api, env, url, database, contract, tron, deploy), along with hostname, cwd, and Node version, and POSTs the JSON payload via http.request to a hardcoded destination whose hostname is encoded as the bare integer 759017974 (decoding to IP 45.55.109.86) on port 61289, under a long random path. Errors are silently swallowed. The advertised main entry index.js is a stub exporting empty get/post/put/delete no-ops, so the manifest plus preinstall is the entire payload; the package presents as an API client while its only real behavior is install-time credential theft.