Malicious npm package steals seed phrases and secrets from environment variables

The @quantixfinance/supabase package masquerades as a Supabase client, but is actually a dummy package: its preinstall script scans environment variables for substrings such as key, secret, token, mnemonic, seed, wallet and private, and sends its findings along with the hostname to a hardcoded attacker server. The package name resembles a specific organization's internal scope — this is a dependency confusion attack intended to trigger automatic installation in someone else's project. If the package ended up in the dependencies, the machine's secrets, including any wallet seed phrases, may already have leaked.