@quantixfinance/config@1.0.0

Analysis

The preinstall hook (preinstall.js) enumerates all environment variables and collects every one whose name contains key, secret, token, pass, supabase, wallet, mnemonic, seed, database, api, deploy, tron, contract, vercel, railway, rpc, infura, alchemy, quicknode, ankr, or env, along with the hostname, working directory, and Node version. It serializes these to JSON and POSTs them to 45[.]61[.]177[.]246:61289 at path /0471e9cef36a6718b0f2bfdbec06bd82/47acfe667ff0162697f4af03/54c960d45ce346f9/r. This exfiltrates the installer's credentials and secrets on install.