@wagni_bot/solana-sdk

{"modified":"2026-07-28T07:58:22Z","published":"2026-07-09T00:00:00Z","schema_version":"1.7.4","id":"MAL-2026-10035","summary":"Malicious code in @wagni_bot/solana-sdk (npm)","details":"The npm package `@wagni_bot/solana-sdk` is a supply-chain credential stealer disguised as a **Solana** SDK. It is one member of a coordinated campaign of 25 crypto/web3 typosquat packages published under the single npm scope `@wagni_bot` on 2026-07-09.\n\nEach package declares a `postinstall` lifecycle hook (`postinstall: node postinstall.js`) that executes automatically on `npm install`, before the package is ever imported. The script fingerprints the host and user (`os.hostname()`, `os.userInfo()`, `os.platform()`), walks the user's home directory (`readdirSync`/`readFileSync`) and reads high-value secrets — SSH private keys (`~/.ssh/id_rsa`), cryptocurrency wallet files, and `.env` files (API keys, tokens, seed phrases). It then JSON-encodes the collected data and exfiltrates it to a hardcoded Telegram bot via the Telegram Bot API `sendMessage` endpoint (https://api.telegram.org/bot8804087989:AAHUia-5DCloXsg9M9QhffTsHO5J_6FAxQM/sendMessage). All error paths are swallowed so the install appears normal.\n\ncodelake Research proved the packages belong to one campaign deterministically: the payload file is byte-identical across all 25 packages at each published version (version-lockstep), and every package exfiltrates to the same Telegram bot token — a single automated actor. Detected and classified independently from the live npm feed on 2026-07-09; at the time of reporting the packages were still live on npm and none of the 25 were present in OSV or GHSA (a first-catch).\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (e15edf4a83ab4894a29882072554e493c1673695d5e6aaa734672ba6da084112)\nPackage @wagni_bot/solana-sdk impersonates a legitimate Solana SDK but contains no SDK functionality — `main` points at postinstall.js, which is a credential-harvesting payload that runs automatically on `npm install` via preinstall/postinstall hooks. On execution the script recursively walks the installer's home directory, Desktop, Documents, Downloads, /root, and /tmp for wallet and secret files (id.json, wallet.json, keypair.json, MetaMask/Phantom extension storage in Chrome/Brave/Edge profiles,.env, seed.txt, mnemonic.txt), and reads SSH private keys (~/.ssh/id_*), AWS credentials (~/.aws/credentials), git credentials,.npmrc,.netrc, and Solana/Ethereum keystores. Collected file contents (up to 10KB each) are bundled with os.hostname(), os.userInfo().username, and cwd, then POSTed in cleartext to http://107.161.90.180:7777. The package name typosquats the Solana SDK ecosystem to lure developers into installing the harvester.\n","affected":[{"package":{"ecosystem":"npm","name":"@wagni_bot/solana-sdk"},"versions":["1.0.0","1.2.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"postinstall.js","sha256":"3d8a59e627a451040c959870dace8fb417d1f9c55c6e2d2190637289212f8b3f","tlsh":"5c8155c4b1fa520958a341eefa5b220210717d573848e4a9fedc9f456f56240af53bfc"},{"path":"package.json","sha256":"65b1b0321120ad8458ec9801342ac23930095173d05dac4b2f6498c3db374264","tlsh":"2ed05e204e505f33b8c81bed0937416aa9f3490b1118292c17df3894874e67b98bb72e"}],"package_integrity":[{"filename":"solana-sdk-1.0.0.tgz","hashes":{"sha1":"a2da22179b6feee14f73568c3e9008f3ed94a853","sha512_sri":"sha512-IsekbLfEF9WDOmQii3NuSZDu8pne4VsOXWN1VKQsUc2Gy9Yif4MPjIVSoR6OD4a5s/Fi7ZXI9tw2CBSdopksjQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@wagni_bot/solana-sdk/v/1.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@wagni_bot/solana-sdk/v/1.2.0"},{"type":"ADVISORY","url":"https://research.codelake.dev/advisories/clr-2026-3003-wagni-solana-sdk"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]},{"name":"codelake Research","type":"FINDER","contact":["https://research.codelake.dev/advisories/clr-2026-3003-wagni-solana-sdk"]}],"database_specific":{"iocs":{"hashes":["sha256:1f150439a46f3fddda321fe45dc1ff99b8f874defb1088edb09873ee5487c766"],"urls":["https://api.telegram.org/bot8804087989:AAHUia-5DCloXsg9M9QhffTsHO5J_6FAxQM/sendMessage"]},"malicious-packages-origins":[{"source":"amazon-inspector","sha256":"a2007f27f9956a58b77a5e6bc010944f866ea375a9e76ef8d080979721e51eba","import_time":"2026-07-09T16:20:36.326758107Z","id":"IN-MAL-2026-009048","modified_time":"2026-07-09T15:20:05Z","versions":["1.0.0"]},{"source":"amazon-inspector","sha256":"e15edf4a83ab4894a29882072554e493c1673695d5e6aaa734672ba6da084112","import_time":"2026-07-09T16:20:33.064753249Z","id":"IN-MAL-2026-009019","modified_time":"2026-07-09T15:15:23Z","versions":["1.2.0"]}]}}