GCVE-110-OSM-2026-11659

The package advertises itself as a wallet library but ships a 67-byte no-op index.js; the entire payload is a preinstall lifecycle script that fires automatically on npm install. The script iterates process.env and selects variables whose names contain any of a broad credential-related substring list (key, secret, token, pass, mnemonic, seed, private, wallet, api, rpc, infura, alchemy, supabase, database, deploy, vercel, railway, tron, contract, env, url), then bundles the matched values together with the machine hostname, current working directory, and Node.js version and POSTs the JSON to a hardcoded remote endpoint. The destination host is written as the 32-bit integer 759017974, which decodes to 45.61.177.246, and the request targets port 61289 with a per-victim GUID-shaped path. The integer-encoded host defeats plain-text URL scanning and there is no documented functionality that would justify the outbound POST. Judge assessment: This package is a credential-theft and exfiltration loader that triggers automatically via the npm preinstall lifecycle, so the attacker model is a supply-chain compromise of developers installing @quantixfinance/wallet. The entrypoint code in preinstall.js enumerates process.env for sensitive keys containing substrings like key, secret, token, mnemonic, seed, wallet, rpc, infura, alchemy, and private, then bundles matched values with hostname, cwd, and Node.js version into a POST request. The hardcoded destination uses the integer host 759017974 (45.61.177.246) on port 61289 with a GUID-like path, and the package has no repository plus a brand-new publisher account, which fits a covert data-stealing implant rather than a legitimate wallet utility. The OSV advisory MAL-2026-15857 is fully corroborated by the actual preinstall.js contents and package.json script wiring. ENTRY preinstall.js (install-hook: node preinstall.js) - Install Hook Executes Local JS File in package.json EXFIL - Environment Variable Exfiltration in preinstall.js: "process.env[k]; } } e._h = o.hostname(); e._c = process.cwd(); e._v = process.ve..." - HTTP Data Exfiltration in preinstall.js: "process.cwd(); e._v = process.version; const d = JSON.stringify(e); const r = h...." ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account PAYLOAD FILES preinstall.js