{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "postinstall.js",
              "sha256": "3d8a59e627a451040c959870dace8fb417d1f9c55c6e2d2190637289212f8b3f",
              "tlsh": "5c8155c4b1fa520958a341eefa5b220210717d573848e4a9fedc9f456f56240af53bfc"
            },
            {
              "path": "package.json",
              "sha256": "65b1b0321120ad8458ec9801342ac23930095173d05dac4b2f6498c3db374264",
              "tlsh": "2ed05e204e505f33b8c81bed0937416aa9f3490b1118292c17df3894874e67b98bb72e"
            }
          ],
          "package_integrity": [
            {
              "filename": "solana-sdk-1.0.0.tgz",
              "hashes": {
                "sha1": "a2da22179b6feee14f73568c3e9008f3ed94a853",
                "sha512_sri": "sha512-IsekbLfEF9WDOmQii3NuSZDu8pne4VsOXWN1VKQsUc2Gy9Yif4MPjIVSoR6OD4a5s/Fi7ZXI9tw2CBSdopksjQ=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "@wagni_bot/solana-sdk"
      },
      "versions": [
        "1.0.0",
        "1.2.0"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    },
    {
      "contact": [
        "https://research.codelake.dev/advisories/clr-2026-3003-wagni-solana-sdk"
      ],
      "name": "codelake Research",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "iocs": {
      "hashes": [
        "sha256:1f150439a46f3fddda321fe45dc1ff99b8f874defb1088edb09873ee5487c766"
      ],
      "urls": [
        "https://api.telegram.org/bot8804087989:AAHUia-5DCloXsg9M9QhffTsHO5J_6FAxQM/sendMessage"
      ]
    },
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-009048",
        "import_time": "2026-07-09T16:20:36.326758107Z",
        "modified_time": "2026-07-09T15:20:05Z",
        "sha256": "a2007f27f9956a58b77a5e6bc010944f866ea375a9e76ef8d080979721e51eba",
        "source": "amazon-inspector",
        "versions": [
          "1.0.0"
        ]
      },
      {
        "id": "IN-MAL-2026-009019",
        "import_time": "2026-07-09T16:20:33.064753249Z",
        "modified_time": "2026-07-09T15:15:23Z",
        "sha256": "e15edf4a83ab4894a29882072554e493c1673695d5e6aaa734672ba6da084112",
        "source": "amazon-inspector",
        "versions": [
          "1.2.0"
        ]
      }
    ]
  },
  "details": "The npm package `@wagni_bot/solana-sdk` is a supply-chain credential stealer disguised as a **Solana** SDK. It is one member of a coordinated campaign of 25 crypto/web3 typosquat packages published under the single npm scope `@wagni_bot` on 2026-07-09.\n\nEach package declares a `postinstall` lifecycle hook (`postinstall: node postinstall.js`) that executes automatically on `npm install`, before the package is ever imported. The script fingerprints the host and user (`os.hostname()`, `os.userInfo()`, `os.platform()`), walks the user\u0027s home directory (`readdirSync`/`readFileSync`) and reads high-value secrets \u2014 SSH private keys (`~/.ssh/id_rsa`), cryptocurrency wallet files, and `.env` files (API keys, tokens, seed phrases). It then JSON-encodes the collected data and exfiltrates it to a hardcoded Telegram bot via the Telegram Bot API `sendMessage` endpoint (https://api.telegram.org/bot8804087989:AAHUia-5DCloXsg9M9QhffTsHO5J_6FAxQM/sendMessage). All error paths are swallowed so the install appears normal.\n\ncodelake Research proved the packages belong to one campaign deterministically: the payload file is byte-identical across all 25 packages at each published version (version-lockstep), and every package exfiltrates to the same Telegram bot token \u2014 a single automated actor. Detected and classified independently from the live npm feed on 2026-07-09; at the time of reporting the packages were still live on npm and none of the 25 were present in OSV or GHSA (a first-catch).\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (e15edf4a83ab4894a29882072554e493c1673695d5e6aaa734672ba6da084112)\nPackage @wagni_bot/solana-sdk impersonates a legitimate Solana SDK but contains no SDK functionality \u2014 `main` points at postinstall.js, which is a credential-harvesting payload that runs automatically on `npm install` via preinstall/postinstall hooks. On execution the script recursively walks the installer\u0027s home directory, Desktop, Documents, Downloads, /root, and /tmp for wallet and secret files (id.json, wallet.json, keypair.json, MetaMask/Phantom extension storage in Chrome/Brave/Edge profiles,.env, seed.txt, mnemonic.txt), and reads SSH private keys (~/.ssh/id_*), AWS credentials (~/.aws/credentials), git credentials,.npmrc,.netrc, and Solana/Ethereum keystores. Collected file contents (up to 10KB each) are bundled with os.hostname(), os.userInfo().username, and cwd, then POSTed in cleartext to http://107.161.90.180:7777. The package name typosquats the Solana SDK ecosystem to lure developers into installing the harvester.\n",
  "id": "MAL-2026-10035",
  "modified": "2026-07-28T07:58:22Z",
  "published": "2026-07-09T00:00:00Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/@wagni_bot/solana-sdk/v/1.0.0"
    },
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/@wagni_bot/solana-sdk/v/1.2.0"
    },
    {
      "type": "ADVISORY",
      "url": "https://research.codelake.dev/advisories/clr-2026-3003-wagni-solana-sdk"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in @wagni_bot/solana-sdk (npm)"
}