@quantixfinance/database@1.0.1

Analysis

The package's preinstall hook (preinstall.js) harvests the installer's environment variables, collecting every variable whose name contains key, secret, token, pass, supabase, wallet, mnemonic, seed, rpc, infura, alchemy, quicknode, ankr, database, api, deploy, or similar, together with the hostname, working directory, and Node version, and POSTs them as JSON to 45[.]59[.]31[.]6:61289 at path /0471e9cef36a6718b0f2bfdbec06bd82/47acfe667ff0162697f4af03/54c960d45ce346f9/r. The credential filter targeting wallet/mnemonic/seed/RPC-provider keys indicates crypto/DeFi credential theft. The hook suppresses all errors to hide the exfiltration.