If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (f2fde29a3682637d696a6bb2614ba4ddf9b7f2b99c3d3a65380ced1ce3d7f57a)
@quantixfinance/sdk@1.0.0 ships an inert library body (index.js exports an empty QuantixSDK class and a createClient stub) while its preinstall lifecycle script performs credential harvesting. On npm install, the preinstall code iterates process.env and collects every variable whose name matches credential-related keywords (key, secret, token, pass, mnemonic, seed, private, wallet, rpc, infura, alchemy, supabase, database, api, deploy, env) along with hostname, cwd, and node version, then POSTs the collected JSON to a hardcoded IPv4 host encoded as an integer literal (759017974, resolving to 45.61.169.150) on port 61289 at path /0471e9cef36a6718b0f2bfdbec06bd82/47acfe667ff0162697f4af03/54c960d45ce346f9/r. Encoding the destination as an integer rather than a dotted-quad or domain evades string/URL scanners. The package's only functional behavior is this exfiltration; the advertised SDK is a decoy.