@quantixfinance/sdk@1.0.0

Analysis

The preinstall hook (preinstall.js) runs on install and harvests the environment: it collects every environment variable whose name contains key, secret, token, password, wallet, mnemonic, seed, private, database, API, RPC, or cloud-provider identifiers (Vercel, Railway, Infura, Alchemy, QuickNode, Ankr, Supabase), along with the hostname, working directory, and Node version, and POSTs the assembled JSON to 45[.]61[.]177[.]246:61289 at path /0471e9cef36a6718b0f2bfdbec06bd82/47acfe667ff0162697f4af03/54c960d45ce346f9/r. The remote host is encoded as the decimal integer 759017974 (0x2D3DB1F6). Errors are silently swallowed so the exfiltration is hidden from the installer.