Malicious code in @wagni_bot/hyperliquid (npm)
A coordinated campaign of 25 malicious npm packages under the @wagni_bot scope, including @wagni_bot/hyperliquid, deployed credential-stealing malware via postinstall hooks. Published 2026-07-09, the packages exfiltrated SSH keys, cryptocurrency wallets, and .env secrets to a single Telegram bot.
- Disclosed
- Last updated
- Blast radius
- Any developer who installed @wagni_bot/* packages between 2026-07-09 and removal; credential exposure (SSH keys, wallet files, .env secrets, API keys, seed phrases).
- Ecosystems
- Attack vectors
- Affected entities
- @wagni_bot/hyperliquidTyposquat of Hyperliquid SDK; part of coordinated 25-package campaign under @wagni_bot scope
The npm package @wagni_bot/hyperliquid is a typosquat of the legitimate Hyperliquid SDK, part of a coordinated supply-chain attack comprising 25 malicious packages published under the @wagni_bot scope on 2026-07-09. Each package declares a postinstall lifecycle hook that executes automatically during npm install, before the package is ever imported by user code.\n\nThe postinstall script performs host and user fingerprinting (hostname, user info, platform), then recursively walks the user's home directory to extract high-value secrets: SSH private keys (~/.ssh/id_rsa), cryptocurrency wallet files, and .env files containing API keys, tokens, and seed phrases. All collected data is JSON-encoded and exfiltrated to a hardcoded Telegram bot via the Telegram Bot API.\n\nResearch by codelake confirmed the campaign is a single automated actor: the payload file is byte-identical across all 25 packages at each version (version-lockstep), and all packages exfiltrate to the same Telegram bot token. Error paths are silently swallowed to avoid detection during installation.\n\nThe packages were detected and reported on 2026-07-09 while still live on npm. The attack vector exploits the automatic execution of postinstall hooks before user code runs, making it effective against any developer who ran npm install on any of the 25 packages.
Indicators of compromise
- Packages
- @wagni_bot/hyperliquid
- Domains
- api.telegram.org
Remediation
- Immediately uninstall @wagni_bot/* packages and any dependencies that may have installed them
- Rotate all SSH private keys, cryptocurrency wallet credentials, and API tokens/secrets that may have been exposed
- Review .env files and environment variables for unauthorized access or exfiltration
- Audit npm install logs and package-lock.json for presence of @wagni_bot packages
- Consider the host compromised if @wagni_bot packages were installed; perform full security audit
- Use npm audit to detect any remaining malicious packages
- Enable npm package signature verification and consider using private registries with stricter controls
Sources
- GitHub Advisory GHSA-35jp-phg5-g2hr · GitHub Advisory Database
Cite this entry
"Malicious code in @wagni_bot/hyperliquid (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 9, 2026; last updated July 28, 2026. https://supplychainattack.org/incident/malicious-code-in-wagni-bot-hyperliquid-npm-1xr3ra
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in @ai_/autoprefixers (npm)
@ai_/autoprefixers is a typosquat of the legitimate autoprefixer package that executes arbitrary attacker-controlled shell commands on installation. The malicious code fetches encrypted payloads from remote C2 servers and decrypts them using a hardcoded key suffix before execution via child_process.exec.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in ethers-secure (npm)
The npm package ethers-secure, which mimics the popular ethers library, contained malicious code that exfiltrated Ethereum private keys to an attacker-controlled server (enjbyg3xk8l.x.pipedream.net) whenever its wallet API was used. The package was identified by Amazon Inspector and credited to the OpenSSF malicious-packages project.
npmCompromised packageTyposquatting - containedcritical
Malicious code in chain-analyze (npm)
The npm package chain-analyze contained malicious code that executed arbitrary Node.js commands on installation. The package impersonated the official Theta blockchain SDK and used a split-package design with a dependency (chain-manager) to hide encrypted payload from scanners.
npmCompromised packageTyposquatting - containedcritical
Malicious code in parallely (npm)
The npm package parallely contains malicious code that impersonates the legitimate concurrently package. When invoked, it executes a dropper that downloads and runs platform-specific payloads after anti-analysis checks.
npmCompromised packageTyposquatting