@wagni_bot/eth-agent@1.1.1

Analysis

The postinstall hook (postinstall.js) runs on install and exfiltrates credentials to a remote server at 107[.]161[.]90[.]180:7777. It collects SSH private keys (id_rsa, id_ed25519) from ~/.ssh/ and the current directory, .pem/.key/.cred files, .env files, and environment variables containing PRIVATE, SECRET, TOKEN, API_KEY, PASSWORD, MNEMONIC, SEED, WALLET, or AWS. All stolen data is POSTed as JSON to hxxp://107[.]161[.]90[.]180:7777. The package contains no functional SDK code — index.js is 19 bytes and the sole purpose is the credential-harvesting postinstall script.