@wagni_bot/binance-sdk@1.0.0

Analysis

@wagni_bot/binance-sdk@1.0.0 is a combosquat package impersonating the Binance crypto exchange SDK. Both the preinstall and postinstall lifecycle hooks execute postinstall.js, which is a credential and cryptocurrency wallet harvester. On install, the script: (1) hunts Solana wallet private keys (id.json) from ~/.config/solana, ~/.solana, and ~/.local/share/solana; (2) hunts Ethereum keystore files from ~/.ethereum/keystore; (3) hunts Bitcoin and Litecoin wallet files; (4) recursively searches the home directory for wallet files, .env, .env.local, and .env.production files; (5) steals SSH private keys from ~/.ssh/; (6) steals AWS credentials from ~/.aws/credentials; (7) steals git credentials from ~/.git-credentials; (8) steals npm auth tokens from ~/.npmrc. All stolen data is exfiltrated via HTTP POST to 107[.]161[.]90[.]180:7777, along with the hostname, username, and current working directory.