{
  "schema_version": "1.6.0",
  "id": "CLR-2026-3020",
  "modified": "2026-07-09T13:30:00Z",
  "published": "2026-07-09T13:30:00Z",
  "summary": "Fake an Ethereum wallet library SDK that steals your SSH keys and crypto wallets on install",
  "details": "The npm package @wagni_bot/ethereum-wallet@1.2.0 poses as a an Ethereum wallet library SDK. It is malware: a postinstall hook that runs the moment you npm install — before any of your code — walks your home directory and reads your SSH private keys (~/.ssh/id_rsa), crypto wallet files and .env secrets, adds host/user recon, and exfiltrates everything to a hard-coded Telegram bot. It is one of 25 packages published under the @wagni_bot scope on the same day, all carrying the identical stealer. Not in OSV at time of writing.",
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@wagni_bot/ethereum-wallet"
      },
      "versions": [
        "1.2.0"
      ]
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://research.codelake.dev/advisories/clr-2026-3020-wagni-ethereum-wallet"
    }
  ],
  "credits": [
    {
      "name": "Sascha Klein, codelake Research",
      "type": "FINDER",
      "contact": [
        "https://research.codelake.dev"
      ]
    }
  ],
  "database_specific": {
    "caseId": "CLR-2026-3020",
    "kind": "malware",
    "class": "SSH-key / crypto-wallet / env stealer",
    "severity": "Critical",
    "status": "Confirmed malicious",
    "iocs": {
      "ips": [],
      "hashes": [
        "sha256:5feab4badcc22976d83f714c4641fe123d8a7f791935a4d26c4bf56b713216be"
      ],
      "indicators": [
        "@wagni_bot/ethereum-wallet@1.2.0 (npm) — published 2026-07-09, still live at time of writing",
        "5feab4badcc22976d83f714c4641fe123d8a7f791935a4d26c4bf56b713216be (tarball)",
        "package.json: \"postinstall\": \"node postinstall.js\" — runs on install, before import",
        "Reads ~/.ssh/id_rsa (SSH keys), crypto wallet files, and .env secrets from the home directory",
        "os.hostname() · os.userInfo() · os.platform()",
        "Telegram Bot API → https://api.telegram.org/bot8804087989:AAHUia-5DCloXsg9M9QhffTsHO5J_6FAxQM/sendMessage (shared by all 25 packages)",
        "@wagni_bot — 25 crypto/web3 typosquat packages, identical payload, single Telegram bot (one actor)"
      ]
    }
  }
}