MAL-2026-10035

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@wagni_bot/solana-sdk/MAL-2026-10035.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-10035
Published
2026-07-09T00:00:00Z
Modified
2026-07-28T08:06:33.677268013Z
Summary
Malicious code in @wagni_bot/solana-sdk (npm)
Details

The npm package @wagni_bot/solana-sdk is a supply-chain credential stealer disguised as a Solana SDK. It is one member of a coordinated campaign of 25 crypto/web3 typosquat packages published under the single npm scope @wagni_bot on 2026-07-09.

Each package declares a postinstall lifecycle hook (postinstall: node postinstall.js) that executes automatically on npm install, before the package is ever imported. The script fingerprints the host and user (os.hostname(), os.userInfo(), os.platform()), walks the user's home directory (readdirSync/readFileSync) and reads high-value secrets — SSH private keys (~/.ssh/id_rsa), cryptocurrency wallet files, and .env files (API keys, tokens, seed phrases). It then JSON-encodes the collected data and exfiltrates it to a hardcoded Telegram bot via the Telegram Bot API sendMessage endpoint (https://api.telegram.org/bot8804087989:AAHUia-5DCloXsg9M9QhffTsHO5J_6FAxQM/sendMessage). All error paths are swallowed so the install appears normal.

codelake Research proved the packages belong to one campaign deterministically: the payload file is byte-identical across all 25 packages at each published version (version-lockstep), and every package exfiltrates to the same Telegram bot token — a single automated actor. Detected and classified independently from the live npm feed on 2026-07-09; at the time of reporting the packages were still live on npm and none of the 25 were present in OSV or GHSA (a first-catch).

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (e15edf4a83ab4894a29882072554e493c1673695d5e6aaa734672ba6da084112)

Package @wagnibot/solana-sdk impersonates a legitimate Solana SDK but contains no SDK functionality — main points at postinstall.js, which is a credential-harvesting payload that runs automatically on npm install via preinstall/postinstall hooks. On execution the script recursively walks the installer's home directory, Desktop, Documents, Downloads, /root, and /tmp for wallet and secret files (id.json, wallet.json, keypair.json, MetaMask/Phantom extension storage in Chrome/Brave/Edge profiles,.env, seed.txt, mnemonic.txt), and reads SSH private keys (~/.ssh/id*), AWS credentials (~/.aws/credentials), git credentials,.npmrc,.netrc, and Solana/Ethereum keystores. Collected file contents (up to 10KB each) are bundled with os.hostname(), os.userInfo().username, and cwd, then POSTed in cleartext to http://107.161.90.180:7777. The package name typosquats the Solana SDK ecosystem to lure developers into installing the harvester.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-07-09T16:20:36.326758107Z",
            "modified_time": "2026-07-09T15:20:05Z",
            "versions": [
                "1.0.0"
            ],
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-009048",
            "sha256": "a2007f27f9956a58b77a5e6bc010944f866ea375a9e76ef8d080979721e51eba"
        },
        {
            "id": "IN-MAL-2026-009019",
            "modified_time": "2026-07-09T15:15:23Z",
            "versions": [
                "1.2.0"
            ],
            "source": "amazon-inspector",
            "import_time": "2026-07-09T16:20:33.064753249Z",
            "sha256": "e15edf4a83ab4894a29882072554e493c1673695d5e6aaa734672ba6da084112"
        }
    ],
    "iocs": {
        "hashes": [
            "sha256:1f150439a46f3fddda321fe45dc1ff99b8f874defb1088edb09873ee5487c766"
        ],
        "urls": [
            "https://api.telegram.org/bot8804087989:AAHUia-5DCloXsg9M9QhffTsHO5J_6FAxQM/sendMessage"
        ]
    }
}
References
Credits

Affected packages

npm / @wagni_bot/solana-sdk

Package

Name
@wagni_bot/solana-sdk
View open source insights on deps.dev
Purl
pkg:npm/%40wagni_bot/solana-sdk

Affected ranges

Affected versions

1.*
1.0.0
1.2.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@wagni_bot/solana-sdk/MAL-2026-10035.json"
indicators 
{
    "evidence_files": [
        {
            "path": "postinstall.js",
            "sha256": "3d8a59e627a451040c959870dace8fb417d1f9c55c6e2d2190637289212f8b3f",
            "tlsh": "5c8155c4b1fa520958a341eefa5b220210717d573848e4a9fedc9f456f56240af53bfc"
        },
        {
            "path": "package.json",
            "sha256": "65b1b0321120ad8458ec9801342ac23930095173d05dac4b2f6498c3db374264",
            "tlsh": "2ed05e204e505f33b8c81bed0937416aa9f3490b1118292c17df3894874e67b98bb72e"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha1": "a2da22179b6feee14f73568c3e9008f3ed94a853",
                "sha512_sri": "sha512-IsekbLfEF9WDOmQii3NuSZDu8pne4VsOXWN1VKQsUc2Gy9Yif4MPjIVSoR6OD4a5s/Fi7ZXI9tw2CBSdopksjQ=="
            },
            "filename": "solana-sdk-1.0.0.tgz"
        }
    ]
}