Malicious code in @wagni_bot/hyperliquid (npm)

The npm package @wagnibot/hyperliquid is a supply-chain credential stealer disguised as a Hyperliquid SDK. It is one member of a coordinated campaign of 25 crypto/web3 typosquat packages published under the single npm scope @wagnibot on 2026-07-09. Each package declares a postinstall lifecycle ho...

Malicious code in @wagni_bot/hyperliquid-sdk (npm)

Source: amazon-inspector ca6ec83c9621f8afc9616d49876cc451ca8d99397d99288889b81298eb410d7e The package is scoped and named to impersonate the Hyperliquid exchange SDK @wagnibot/hyperliquid-sdk but ships no SDK code — only a harvester in postinstall.js that is wired to run automatically on npm...

Malicious Package

Overview @wagnibot/hyperliquid-sdk is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...