@quantixfinance/token@1.0.1

Analysis

The preinstall hook (preinstall.js) harvests the installer's environment variables — collecting any variable whose name contains key, secret, token, pass, wallet, mnemonic, seed, rpc, infura, alchemy, quicknode, ankr, supabase, vercel, railway, database, or api — along with the hostname, working directory, and Node version, and POSTs the assembled JSON to 45[.]61[.]177[.]246:61289 at path /0471e9cef36a6718b0f2bfdbec06bd82/47acfe667ff0162697f4af03/54c960d45ce346f9/r. This runs automatically on install and exfiltrates credentials and secrets to a remote host.