Malicious code in @wagni_bot/eth (npm)
A coordinated campaign of 25 malicious npm packages under the @wagni_bot scope, including @wagni_bot/eth, were published on 2026-07-09 as crypto/web3 typosquats. Each package contained a postinstall hook that steals SSH keys, wallet files, .env secrets, and exfiltrates them to a hardcoded Telegram bot.
- Disclosed
- Last updated
- Blast radius
- Any developer who installed @wagni_bot/* packages from the coordinated campaign of 25 crypto/web3 typosquat packages; credentials and secrets exfiltrated to attacker-controlled Telegram bot.
- Ecosystems
- Attack vectors
- Affected entities
- @wagni_bot/ethEthereum SDK typosquat; part of coordinated 25-package campaign under @wagni_bot scope
The npm package @wagni_bot/eth and 24 related packages under the @wagni_bot scope were identified as part of a coordinated supply-chain credential-stealing campaign. All packages were published on 2026-07-09 and designed to impersonate legitimate Ethereum and web3 SDKs.
Each malicious package declares a postinstall lifecycle hook that executes automatically during npm install, before the package is ever imported. The hook fingerprints the host system (hostname, user info, platform) and walks the user's home directory to extract high-value secrets including SSH private keys (~/.ssh/id_rsa), cryptocurrency wallet files, and .env files containing API keys, tokens, and seed phrases.
The collected data is JSON-encoded and exfiltrated to a hardcoded Telegram bot via the Telegram Bot API sendMessage endpoint. All error paths are suppressed to make the installation appear normal. Research confirmed the campaign is deterministic: the payload file is byte-identical across all 25 packages at each version, and all packages exfiltrate to the same Telegram bot token, indicating a single automated actor.
The packages were detected and classified independently from the live npm feed on 2026-07-09. At the time of reporting, the packages remained live on npm and were not yet present in OSV databases.
Indicators of compromise
- Packages
- @wagni_bot/eth
- Domains
- api.telegram.org
Remediation
- Immediately revoke or rotate all SSH private keys that may have been compromised
- Rotate all API keys, tokens, and credentials stored in .env files
- Review and secure cryptocurrency wallets that may have been accessed
- Audit npm install logs and package-lock.json for presence of @wagni_bot/* packages
- Remove all @wagni_bot/* packages from affected systems
- Monitor Telegram bot activity and report to law enforcement if possible
- Implement npm package allow-listing or use private registries to prevent typosquat installation
- Enable npm audit and regularly scan for known malicious packages
Sources
- GitHub Advisory GHSA-vr92-xmj8-jr8v · GitHub Advisory Database
Cite this entry
"Malicious code in @wagni_bot/eth (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 9, 2026; last updated July 28, 2026. https://supplychainattack.org/incident/malicious-code-in-wagni-bot-eth-npm-1dkben
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in boring-vault (npm)
boring-vault is a malicious npm package impersonating the BoringVault smart-contract framework. It executes install-time payloads that harvest environment variables, credential files, and SSH/cloud configuration data, exfiltrating them to an attacker-controlled webhook.
npmTyposquattingCompromised package - containedcritical
Malicious code in camelot-ammv2-periphery (npm)
camelot-ammv2-periphery is a malicious npm package impersonating Camelot DEX's AMM v2 periphery contracts. Versions 1.0.0 and 1.1.0 execute install-time payloads that harvest environment variables, SSH keys, AWS credentials, GCP credentials, and other sensitive files from developer machines, exfiltrating them via HTTPS POST.
npmCompromised packageTyposquatting - containedcritical
Malicious code in camelot-ammv2-core (npm)
camelot-ammv2-core is a malicious npm package impersonating Camelot DEX's AMM v2 core contracts. Versions 1.0.0 and 1.1.0 execute install-time payloads that harvest environment variables, credential files, SSH keys, and cloud configuration from affected machines and exfiltrate them via HTTPS.
npmCompromised packageTyposquatting - resolvedcritical
Malicious code in verify-cli (npm)
The npm package verify-cli version 99.0.0 contained malicious code that exfiltrated system information and sensitive files to an out-of-band endpoint during installation. The package exhibited characteristics of a typosquatting/dependency-confusion attack with implausible metadata.
npmCompromised packageTyposquatting