⛔ Malware Advisory Detected 2026-07-09 · codelake dropper pipeline
Confirmed malicious. codelake independently detected this at 2026-07-09 · codelake dropper pipeline — Detected independently from the live npm feed by codelake's install-hook dropper pipeline on the day of publication (first-catch: not in OSV or GHSA at detection). Coordination proven deterministically: the payload file is byte-identical across all 25 @wagni_bot packages at each version, and all 25 exfiltrate to a single shared Telegram bot token. An npm takedown report covering the whole scope was filed, and the campaign is now catalogued in the OpenSSF malicious-packages / OSV database as MAL-2026-10026 (from the codelake report, merged 2026-07-28).. Not yet in any public advisory database at detection time — codelake is the source of record.
Advisory · CLR-2026-3013

Fake Hyperliquid SDK that steals your SSH keys and crypto wallets on install

The npm package @wagni_bot/[email protected] poses as a Hyperliquid SDK. It is malware: a postinstall hook that runs the moment you npm install — before any of your code — walks your home directory and reads your SSH private keys (~/.ssh/id_rsa), crypto wallet files and .env secrets, adds host/user recon, and exfiltrates everything to a hard-coded Telegram bot. It is one of 25 packages published under the @wagni_bot scope on the same day, all carrying the identical stealer. Not in OSV at time of writing.

CriticalConfirmed maliciousSSH-key + wallet stealerTelegram exfil25-package campaignNovel — not in OSV
Summary

The npm package @wagni_bot/hyperliquid-sdk (published 2026-07-09) advertises itself as a Hyperliquid SDK — a lure aimed at crypto/web3 developers. It is a credential and wallet stealer.

Its package.json declares a postinstall hook (node postinstall.js), so the payload runs automatically on npm install, before the package is ever imported — including in CI, containers and developer machines. A small index.js stub provides cover.

This is not an isolated package. It is one of 25 crypto/web3 typosquats published under the single @wagni_bot scope on the same day. codelake proved they belong together deterministically: the payload file is byte-identical across all packages at each version (the actor re-published the same stealer in lockstep, iterating versions 1.0.0 → 1.2.0 through the day), and every package exfiltrates to one shared Telegram bot.

What the postinstall payload does

1 · Host + user fingerprint. Reads os.hostname(), os.userInfo() and os.platform() to tag the victim.

2 · Home-directory harvest. Walks the user's home directory (readdirSync/readFileSync) and reads high-value secrets: ~/.ssh/id_rsa (SSH private keys), crypto wallet files, and .env files (API keys, tokens, seed phrases).

3 · Exfiltration to Telegram. The collected data is JSON.stringify-packaged and POSTed to the Telegram Bot API (sendMessage) using a hard-coded bot token and chat id — a low-friction, hard-to-block C2 channel. All error paths are swallowed so the install looks normal.

Same payload, 25 packages. The exact bytes of this payload appear in every other @wagni_bot package at the matching version, and the Telegram bot token is identical across all of them — the signature of a single automated campaign.

The campaign — all 25 packages

This package is one member of a 25-package coordinated campaign published under the single npm scope @wagni_bot on 2026-07-09. Every package below carries the same install-time stealer and exfiltrates to the same Telegram bot. Each has its own advisory:

@wagni_bot/metemask-sdk (CLR-2026-3000, MetaMask (misspelled "metemask"))
@wagni_bot/metamask (CLR-2026-3001, MetaMask)
@wagni_bot/binance-sdk (CLR-2026-3002, Binance)
@wagni_bot/solana-sdk (CLR-2026-3003, Solana)
@wagni_bot/jupiter-sdk (CLR-2026-3004, Jupiter (Solana DEX aggregator))
@wagni_bot/orca-sdk (CLR-2026-3005, Orca (Solana DEX))
@wagni_bot/meteora-sdk (CLR-2026-3006, Meteora (Solana DEX))
@wagni_bot/pumpfun-sdk (CLR-2026-3007, Pump.fun)
@wagni_bot/opensea (CLR-2026-3008, OpenSea)
@wagni_bot/opensea-sdk (CLR-2026-3009, OpenSea)
@wagni_bot/polymarket (CLR-2026-3010, Polymarket)
@wagni_bot/polymarket-sdk (CLR-2026-3011, Polymarket)
@wagni_bot/hyperliquid (CLR-2026-3012, Hyperliquid)
@wagni_bot/hyperliquid-sdk — this advisory (CLR-2026-3013)
@wagni_bot/polygon (CLR-2026-3014, Polygon)
@wagni_bot/polygon-sdk (CLR-2026-3015, Polygon)
@wagni_bot/bsc (CLR-2026-3016, BNB Smart Chain (BSC))
@wagni_bot/bsc-sdk (CLR-2026-3017, BNB Smart Chain (BSC))
@wagni_bot/eth (CLR-2026-3018, Ethereum)
@wagni_bot/eth-agent (CLR-2026-3019, Ethereum)
@wagni_bot/ethereum-wallet (CLR-2026-3020, an Ethereum wallet library)
@wagni_bot/web3 (CLR-2026-3021, web3.js)
@wagni_bot/web3-agent (CLR-2026-3022, web3.js)
@wagni_bot/web3-toolkit (CLR-2026-3023, web3.js)
@wagni_bot/wagni (CLR-2026-3024, the campaign's own namesake handle)

Indicators & characteristics
PKG@wagni_bot/[email protected] (npm) — published 2026-07-09, still live at time of writing
SHA256afbabdb7a3d9d73a22185b1a09b667f3d15b3b96536f0bacd32f52b809c68e37 (tarball)
HOOKpackage.json: "postinstall": "node postinstall.js" — runs on install, before import
THEFTReads ~/.ssh/id_rsa (SSH keys), crypto wallet files, and .env secrets from the home directory
RECONos.hostname() · os.userInfo() · os.platform()
EXFILTelegram Bot API → https://api.telegram.org/bot8804087989:AAHUia-5DCloXsg9M9QhffTsHO5J_6FAxQM/sendMessage (shared by all 25 packages)
SCOPE@wagni_bot — 25 crypto/web3 typosquat packages, identical payload, single Telegram bot (one actor)
Response & guidance
#ActionPriority
01 Do not install it. If @wagni_bot/hyperliquid-sdk (or any @wagni_bot package) appeared in a build or a developer machine, treat that host as compromised. Critical
02 Rotate SSH keys immediately. ~/.ssh/id_rsa was read and exfiltrated — replace the keypair and remove the old public key from every server, GitHub/GitLab, and CI. Critical
03 Move crypto funds and rotate wallet secrets. Wallet files and .env seed phrases/keys were harvested — assume any hot wallet reachable from that machine is compromised and sweep funds to a fresh wallet. Critical
04 Rotate all environment secrets present on the affected machine/CI (.env and process secrets were targeted). Critical
05 Block egress to the Telegram Bot API from build/CI runners that never legitimately use it, and treat postinstall hooks in freshly published crypto "SDK" packages as suspect (npm install --ignore-scripts). Recommended
06 Reported to npm for takedown of the whole @wagni_bot scope — still live at time of writing. Not catalogued in OSV/GHSA; an OpenSSF malicious-packages record is the appropriate catalogue home. Done

Detected + classified independently by codelake Research via its install-hook dropper-hunting pipeline on the day of publication · deterministic structural analysis of the packed tarballs (package.json hook, postinstall payload, exfil destination) · campaign membership proven by byte-identical payload hashing across all 25 packages and a shared Telegram exfil token. Not catalogued in OSV/GHSA at time of writing; an npm takedown report for the whole @wagni_bot scope has been filed.

This is a confirmed-malware advisory. No working payload or reproduction is published — the behaviour is described from structural analysis, and the Telegram exfil endpoint is named as a defensive indicator only. The original artifacts are preserved in the codelake archive and available to verified security researchers on request.