Malicious code in @wagni_bot/eth (npm)

The npm package @wagnibot/eth is a supply-chain credential stealer disguised as a Ethereum SDK. It is one member of a coordinated campaign of 25 crypto/web3 typosquat packages published under the single npm scope @wagnibot on 2026-07-09. Each package declares a postinstall lifecycle hook...

Malicious code in @wagni_bot/eth-agent (npm)

Source: amazon-inspector 08c234c984ea87a7d4c780dc8ddbc244926628e405ea0f7ac9798309260a6122 The package advertises itself as an 'Unofficial eth-agent SDK' but ships an empty main module index.js contains only module.exports = ; its sole runtime behavior is a postinstall lifecycle script that fires...