@quantixfinance/ui@1.0.0

Analysis

The preinstall hook (preinstall.js) harvests the installer's environment variables — collecting every env var whose name contains key, secret, token, pass, wallet, mnemonic, seed, rpc, infura, alchemy, quicknode, ankr, database, api, deploy, vercel, railway, or similar — along with the hostname, working directory, and Node version, and POSTs the collected data as JSON to 45[.]62[.]1[.]246:61289 at path /0471e9cef36a6718b0f2bfdbec06bd82/47acfe667ff0162697f4af03/54c960d45ce346f9/r. The package ships no real UI code; its only behaviour is this credential exfiltration on install.