GCVE-110-OSM-2026-11654

@quantixfinance/sdk@1.0.0 ships an inert library body (index.js exports an empty QuantixSDK class and a createClient stub) while its preinstall lifecycle script performs credential harvesting. On npm install, the preinstall code iterates process.env and collects every variable whose name matches credential-related keywords (key, secret, token, pass, mnemonic, seed, private, wallet, rpc, infura, alchemy, supabase, database, api, deploy, env) along with hostname, cwd, and node version, then POSTs the collected JSON to a hardcoded IPv4 host encoded as an integer literal (759017974, resolving to 45.61.169.150) on port 61289 at path /0471e9cef36a6718b0f2bfdbec06bd82/47acfe667ff0162697f4af03/54c960d45ce346f9/r. Encoding the destination as an integer rather than a dotted-quad or domain evades string/URL scanners. The package's only functional behavior is this exfiltration; the advertised SDK is a decoy. Judge assessment: This package is a credential-harvesting install-time implant: `package.json` runs `node preinstall.js`, and `preinstall.js` iterates `process.env` for secrets-related names (`key`, `secret`, `token`, `mnemonic`, `seed`, `wallet`, `rpc`, `infura`, `alchemy`, etc.) before POSTing the collected JSON over HTTP. The destination is hardcoded as an encoded IPv4 host (`759017974`, resolving to 45.61.169.150) on port 61289 with a fixed path, which is classic attacker-controlled exfiltration and not legitimate SDK behavior. The attacker model is a supply-chain opportunist publishing a decoy npm package under a brand-new account to steal developer secrets at install time. The OSV advisory `MAL-2026-15852` is fully corroborated by the actual entrypoint content and install-hook findings. ENTRY preinstall.js (install-hook: node preinstall.js) - Install Hook Executes Local JS File in package.json EXFIL - Environment Variable Exfiltration in preinstall.js: "process.env[k]; } } e._h = o.hostname(); e._c = process.cwd(); e._v = process.ve..." - HTTP Data Exfiltration in preinstall.js: "process.cwd(); e._v = process.version; const d = JSON.stringify(e); const r = h...." ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account PAYLOAD FILES preinstall.js