Malicious code in @wagni_bot/metamask (npm)
The npm package @wagni_bot/metamask is a credential stealer disguised as a MetaMask SDK, part of a coordinated campaign of 25 typosquat packages published under @wagni_bot on 2026-07-09. Each package executes a postinstall hook that exfiltrates SSH keys, cryptocurrency wallets, and .env files to a hardcoded Telegram bot.
- Disclosed
- Last updated
- Blast radius
- All npm users who installed any of the 25 @wagni_bot packages between 2026-07-09 and removal; credential theft affects downstream users and services.
- Ecosystems
- Attack vectors
- Affected entities
- @wagni_bot/metamaskTyposquat of MetaMask SDK; part of coordinated 25-package campaign under @wagni_bot scope
The npm package @wagni_bot/metamask and 24 related packages under the @wagni_bot scope were published on 2026-07-09 as a coordinated supply-chain credential theft campaign. Each package declares a postinstall lifecycle hook that executes automatically during npm install, before the package is ever imported by user code.
The postinstall script fingerprints the host and user by reading os.hostname(), os.userInfo(), and os.platform(), then walks the user's home directory to extract high-value secrets: SSH private keys (~/.ssh/id_rsa), cryptocurrency wallet files, and .env files containing API keys, tokens, and seed phrases. All collected data is JSON-encoded and exfiltrated to a hardcoded Telegram bot via the Telegram Bot API sendMessage endpoint. Error handling is suppressed to make the installation appear normal.
Research by codelake confirmed the 25 packages belong to a single automated actor: the payload file is byte-identical across all packages at each version (version-lockstep), and all exfiltrate to the same Telegram bot token. The packages were detected and classified on 2026-07-09 and were still live on npm at the time of reporting.
Indicators of compromise
- Packages
- @wagni_bot/metamask
- Domains
- api.telegram.org
Remediation
- Immediately uninstall @wagni_bot/metamask and all other @wagni_bot packages from affected systems
- Rotate all SSH keys, API tokens, and cryptocurrency wallet credentials that may have been exposed
- Review npm audit logs and package.json lock files for any @wagni_bot installations
- If installed, assume SSH keys, .env files, and wallet data have been compromised and take immediate action to revoke/rotate credentials
- Monitor for unauthorized access to SSH accounts, cloud services, and cryptocurrency wallets
- Report the incident to npm security and affected service providers
Sources
- GitHub Advisory GHSA-vg7p-qg4j-56rc · GitHub Advisory Database
Cite this entry
"Malicious code in @wagni_bot/metamask (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 9, 2026; last updated July 28, 2026. https://supplychainattack.org/incident/malicious-code-in-wagni-bot-metamask-npm-9kr14n
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in @ai_/autoprefixers (npm)
@ai_/autoprefixers is a typosquat of the legitimate autoprefixer package that executes arbitrary attacker-controlled shell commands on installation. The malicious code fetches encrypted payloads from remote C2 servers and decrypts them using a hardcoded key suffix before execution via child_process.exec.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in ethers-secure (npm)
The npm package ethers-secure, which mimics the popular ethers library, contained malicious code that exfiltrated Ethereum private keys to an attacker-controlled server (enjbyg3xk8l.x.pipedream.net) whenever its wallet API was used. The package was identified by Amazon Inspector and credited to the OpenSSF malicious-packages project.
npmCompromised packageTyposquatting - containedcritical
Malicious code in chain-analyze (npm)
The npm package chain-analyze contained malicious code that executed arbitrary Node.js commands on installation. The package impersonated the official Theta blockchain SDK and used a split-package design with a dependency (chain-manager) to hide encrypted payload from scanners.
npmCompromised packageTyposquatting - containedcritical
Malicious code in parallely (npm)
The npm package parallely contains malicious code that impersonates the legitimate concurrently package. When invoked, it executes a dropper that downloads and runs platform-specific payloads after anti-analysis checks.
npmCompromised packageTyposquatting