@wagni_bot/ethereum-wallet@1.0.0
Malicious code in @wagni_bot/ethereum-wallet (npm)
T1195.002 · Compromise Software Supply ChainT1059.007 · JavaScriptT1082 · System Information DiscoveryT1552.001 · Credentials In FilesT1005 · Data from Local SystemT1041 · Exfiltration Over C2 Channel
Analysis
On install, the package runs postinstall.js which performs host fingerprinting (hostname, username, cwd) and then hunts for cryptocurrency wallet files (Solana id.json, Ethereum keystore, Bitcoin/Litecoin wallet.dat, mnemonic/seed/recovery files), environment files (.env, .env.local, .env.production), SSH private keys, AWS credentials (~/.aws/credentials), git credentials (~/.git-credentials), and npm auth tokens (~/.npmrc containing authToken). All discovered secrets are exfiltrated via HTTP POST to 107[.]161[.]90[.]180:7777 as JSON.
- analyzed by
- Leitwacht
- first seen
- Jul 9, 2026, 11:43 AM
- analyzed
- Jul 9, 2026, 11:44 AM
Related advisories
- @wagni_bot/pumpfun-sdk@1.2.0
- @wagni_bot/jupiter-sdk@1.2.0
- @wagni_bot/solana-sdk@1.2.0
- @wagni_bot/solana-sdk@1.0.0
- @wagni_bot/orca-sdk@1.0.0
- ts-eslint-jest@1.0.0
- jest-formatter@1.0.0
- zredis-typed@1.0.127
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.