{
  "schema_version": "1.6.0",
  "id": "CLR-2026-3021",
  "modified": "2026-07-09T13:30:00Z",
  "published": "2026-07-09T13:30:00Z",
  "summary": "Fake web3.js SDK that steals your SSH keys and crypto wallets on install",
  "details": "The npm package @wagni_bot/web3@1.0.0 poses as a web3.js SDK. It is malware: a postinstall hook that runs the moment you npm install — before any of your code — walks your home directory and reads your SSH private keys (~/.ssh/id_rsa), crypto wallet files and .env secrets, adds host/user recon, and exfiltrates everything to a hard-coded Telegram bot. It is one of 25 packages published under the @wagni_bot scope on the same day, all carrying the identical stealer. Not in OSV at time of writing.",
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@wagni_bot/web3"
      },
      "versions": [
        "1.0.0"
      ]
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://research.codelake.dev/advisories/clr-2026-3021-wagni-web3"
    }
  ],
  "credits": [
    {
      "name": "Sascha Klein, codelake Research",
      "type": "FINDER",
      "contact": [
        "https://research.codelake.dev"
      ]
    }
  ],
  "database_specific": {
    "caseId": "CLR-2026-3021",
    "kind": "malware",
    "class": "SSH-key / crypto-wallet / env stealer",
    "severity": "Critical",
    "status": "Confirmed malicious",
    "iocs": {
      "ips": [],
      "hashes": [
        "sha256:758d5e20b352c8db926c620a7b5b20bdd194a7cf8b22e93a3d86830bb186f9cb"
      ],
      "indicators": [
        "@wagni_bot/web3@1.0.0 (npm) — published 2026-07-09, still live at time of writing",
        "758d5e20b352c8db926c620a7b5b20bdd194a7cf8b22e93a3d86830bb186f9cb (tarball)",
        "package.json: \"postinstall\": \"node postinstall.js\" — runs on install, before import",
        "Reads ~/.ssh/id_rsa (SSH keys), crypto wallet files, and .env secrets from the home directory",
        "os.hostname() · os.userInfo() · os.platform()",
        "Telegram Bot API → https://api.telegram.org/bot8804087989:AAHUia-5DCloXsg9M9QhffTsHO5J_6FAxQM/sendMessage (shared by all 25 packages)",
        "@wagni_bot — 25 crypto/web3 typosquat packages, identical payload, single Telegram bot (one actor)"
      ]
    }
  }
}