@quantixfinance/auth@1.0.0

Analysis

The package's preinstall hook (preinstall.js) harvests the installer's environment variables whose names match credential patterns (key, secret, token, password, wallet, mnemonic, seed, database, API, RPC, infura, alchemy, quicknode, ankr, vercel, railway, supabase, deploy, contract, tron), along with the hostname, working directory, and Node version, and POSTs them as a JSON body to a remote host at 45[.]61[.]177[.]246:61289 (path /0471e9cef36a6718b0f2bfdbec06bd82/47acfe667ff0162697f4af03/54c960d45ce346f9/r). The remote host address is encoded as the integer 759017974. This exfiltrates the victim's credentials and secrets at install time.