MAL-2026-15853
Malicious code in @quantixfinance/supabase (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (957f7218e15bdaaead1d170d28c2b67949c808b52985e36ec2f993573af1312f) The package's preinstall lifecycle script enumerates process.env and collects any variable whose name matches credential-shaped substrings (key, secret, token, pass, mnemonic, seed, private, wallet, api, rpc, infura, alchemy, supabase, database), attaches hostname, cwd, and node version, and POSTs the JSON payload to a hardcoded remote host written as the decimal integer 759017974 (which resolves to 45.63.10.182) on port 61289. The integer form of the destination host defeats plain-text IOC scanning. The package's index.js is a non-functional stub that exports a no-op createClient returning empty results, confirming the library body is cover and the package exists solely to run the install-time credential stealer. The scoped name resembles a private/internal organization scope, consistent with a dependency-confusion delivery shape.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for @quantixfinance/supabase (npm). Pin to a known-safe version or switch to an alternative.