GCVE-110-OSM-2026-11658

The package advertises itself as a UI component library but index.js only exports empty stub Button/Input/Card functions. The real behavior is in preinstall.js, which runs automatically on `npm install`. That script iterates process.env and collects any variable whose name matches a credential/wallet/RPC keyword list (key, secret, token, pass, mnemonic, seed, wallet, private, api, rpc, infura, alchemy, supabase, vercel, etc.), attaches hostname, cwd, and Node version, and POSTs the resulting JSON to an IPv4 destination written as the 32-bit integer 759017974 (resolves to 45.61.169.182) on port 61289. Encoding the destination as a decimal integer literal instead of a dotted-quad string is an evasion technique against naive string/regex scanners; Node's http.request accepts the numeric form and connects normally. The stub-UI-plus-preinstall-payload shape indicates the package exists solely to be installed under the assumption it is a real finance/crypto UI library and run its install-time secret harvester against the installer. Judge assessment: This is an install-time credential harvester disguised as a UI library: `package.json` runs `node preinstall.js`, and that script enumerates `process.env` for sensitive names like `key`, `secret`, `token`, `mnemonic`, `seed`, `wallet`, `rpc`, `infura`, and `alchemy` before POSTing the collected JSON off-box. The attacker model is a supply-chain actor targeting developers or CI systems that install `@quantixfinance/ui`, with the explicit goal of stealing secrets during `npm install`. The numeric host literal `759017974` resolving to `45.61.169.182` on port `61289` is a clear evasion tactic, and the stubbed UI-package context matches the OSV advisory's description. The very new publisher account and brand-new package strengthen the conclusion that this package was created for malicious exfiltration, not legitimate UI functionality. ENTRY preinstall.js (install-hook: node preinstall.js) - Install Hook Executes Local JS File in package.json EXFIL - Environment Variable Exfiltration in preinstall.js: "process.env[k]; } } e._h = o.hostname(); e._c = process.cwd(); e._v = process.ve..." - HTTP Data Exfiltration in preinstall.js: "process.cwd(); e._v = process.version; const d = JSON.stringify(e); const r = h...." ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account PAYLOAD FILES preinstall.js