Malicious code in @quantixfinance/config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3064c4e02a71b4d0369c649c6aafe3ed3ecde9e7d119e368b42dc7507ae2bb03 The package's preinstall lifecycle script enumerates process.env and filters keys by a broad secret-shaped substring list key, secret, token, pass,...

MAL-2026-15850 Malicious code in @quantixfinance/config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3064c4e02a71b4d0369c649c6aafe3ed3ecde9e7d119e368b42dc7507ae2bb03 The package's preinstall lifecycle script enumerates process.env and filters keys by a broad secret-shaped substring list key, secret, token, pass,...

Malicious code in @quantixfinance/tron (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dcf106f622a8d60232e7d296737eab7e44ffc42a598f40b4b2afea24aaa15f7c The package's declared preinstall script iterates process.env, filters keys against a broad credential/secret keyword list key, secret, token, pass,...

Malicious code in @quantixfinance/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be7f05a2980d77035384d4d27df1058513e5cd1cff50fb5ce040e85986fe0231 The package's preinstall lifecycle script iterates process.env and collects any variable whose name matches a broad list of secret-shaped substrings...

MAL-2026-15849 Malicious code in @quantixfinance/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be7f05a2980d77035384d4d27df1058513e5cd1cff50fb5ce040e85986fe0231 The package's preinstall lifecycle script iterates process.env and collects any variable whose name matches a broad list of secret-shaped substrings...

Malicious code in @quantixfinance/sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f2fde29a3682637d696a6bb2614ba4ddf9b7f2b99c3d3a65380ced1ce3d7f57a @quantixfinance/[email protected] ships an inert library body index.js exports an empty QuantixSDK class and a createClient stub while its preinstall lifecyc...

MAL-2026-15852 Malicious code in @quantixfinance/sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f2fde29a3682637d696a6bb2614ba4ddf9b7f2b99c3d3a65380ced1ce3d7f57a @quantixfinance/[email protected] ships an inert library body index.js exports an empty QuantixSDK class and a createClient stub while its preinstall lifecyc...

MAL-2026-15851 Malicious code in @quantixfinance/contracts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 497edc9bba37d0fd2fb3de0fccd537904ae37848535519f4d334c38d8b59d3bf The package's preinstall lifecycle script iterates process.env and filters keys for credential-shaped substrings key, secret, token, pass, mnemonic,...

Malicious code in @quantixfinance/contracts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 497edc9bba37d0fd2fb3de0fccd537904ae37848535519f4d334c38d8b59d3bf The package's preinstall lifecycle script iterates process.env and filters keys for credential-shaped substrings key, secret, token, pass, mnemonic,...

Malicious code in @quantixfinance/ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 32aaaa83ee6908df0267edb30ac90d4c87ef22bb803f2aca0c97b15348af95d4 The package advertises itself as a UI component library but index.js only exports empty stub Button/Input/Card functions. The real behavior is in...

MAL-2026-15856 Malicious code in @quantixfinance/ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 32aaaa83ee6908df0267edb30ac90d4c87ef22bb803f2aca0c97b15348af95d4 The package advertises itself as a UI component library but index.js only exports empty stub Button/Input/Card functions. The real behavior is in...

MAL-2026-15857 Malicious code in @quantixfinance/wallet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 18cabdbe5d59eb5064ea44a0a73db01d23affa7975049251454f599210aa79e3 The package advertises itself as a wallet library but ships a 67-byte no-op index.js; the entire payload is a preinstall lifecycle script that fires...

Malicious code in @quantixfinance/wallet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 18cabdbe5d59eb5064ea44a0a73db01d23affa7975049251454f599210aa79e3 The package advertises itself as a wallet library but ships a 67-byte no-op index.js; the entire payload is a preinstall lifecycle script that fires...

Malicious code in @quantixfinance/token (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f96bd0164caad38003a2571cdf5e346be6c9d6d6ca51906a5661a2004aa3afb3 The package's preinstall lifecycle script enumerates process.env and collects any variable whose name matches credential-shaped keywords key, secret,...

MAL-2026-15854 Malicious code in @quantixfinance/token (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f96bd0164caad38003a2571cdf5e346be6c9d6d6ca51906a5661a2004aa3afb3 The package's preinstall lifecycle script enumerates process.env and collects any variable whose name matches credential-shaped keywords key, secret,...

Malicious code in @quantixfinance/supabase (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 957f7218e15bdaaead1d170d28c2b67949c808b52985e36ec2f993573af1312f The package's preinstall lifecycle script enumerates process.env and collects any variable whose name matches credential-shaped substrings key, secre...

MAL-2026-15853 Malicious code in @quantixfinance/supabase (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 957f7218e15bdaaead1d170d28c2b67949c808b52985e36ec2f993573af1312f The package's preinstall lifecycle script enumerates process.env and collects any variable whose name matches credential-shaped substrings key, secre...

Malicious code in @quantixfinance/api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 574ee760d08ba89b3c9a06d87af077eac7166d12ed8a98b00a30298c0236b6e7 The package's preinstall lifecycle script runs automatically on npm install. It iterates process.env and collects every variable whose name contains...

MAL-2026-15848 Malicious code in @quantixfinance/api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 574ee760d08ba89b3c9a06d87af077eac7166d12ed8a98b00a30298c0236b6e7 The package's preinstall lifecycle script runs automatically on npm install. It iterates process.env and collects every variable whose name contains...

CVE-2026-85227

MISP contains a reflected Cross-Site Scripting XSS vulnerability in the event attribute filtering query builder. The taggedAttributes and galaxyAttachedAttributes URL parameters were inserted into the query-builder rules without HTML escaping before being serialized as JSON and embedded inside a...