@quantixfinance/tron@1.0.0
Malicious code in @quantixfinance/tron (npm)
T1059.007 · JavaScriptT1552.001 · Credentials In FilesT1071.001 · Web ProtocolsT1041 · Exfiltration Over C2 Channel
Analysis
The preinstall hook (preinstall.js) harvests the installer's environment variables whose names match key/secret/token/pass/mnemonic/seed/wallet/private/rpc/infura/alchemy/quicknode/ankr/env, along with hostname, working directory, and Node version, and POSTs them as JSON to 45[.]58[.]44[.]118:61289 at path /0471e9cef36a6718b0f2bfdbec06bd82/47acfe667ff0162697f4af03/54c960d45ce346f9/r. This exfiltrates credentials, API keys, wallet seeds, and database/cloud tokens from the installing environment.
- analyzed by
- Leitwacht
- first seen
- Sep 3, 2026, 08:43 AM
- analyzed
- Sep 3, 2026, 08:44 AM
Related advisories
- @quantixfinance/database@1.0.1
- @quantixfinance/token@1.0.1
- @quantixfinance/contracts@1.0.0
- @quantixfinance/ui@1.0.0
- @quantixfinance/supabase@1.0.0
- @quantixfinance/config@1.0.0
- @quantixfinance/auth@1.0.0
- tailwind-contact-forms@0.5.12
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.