@quantixfinance/api@1.0.0

Analysis

The preinstall hook (preinstall.js) harvests the installer's environment variables — collecting every variable whose name contains key, secret, token, pass, supabase, wallet, mnemonic, seed, rpc, infura, alchemy, quicknode, ankr, vercel, railway, database, or api — along with the hostname, working directory, and Node version, and POSTs them as JSON to 45[.]61[.]177[.]246:61289 at path /0471e9cef36a6718b0f2bfdbec06bd82/47acfe667ff0162697f4af03/54c960d45ce346f9/r. The exfiltration runs automatically on package install and suppresses all errors to avoid detection.