Malicious code in @wagni_bot/web3 (npm)

The npm package @wagnibot/web3 is a supply-chain credential stealer disguised as a web3.js SDK. It is one member of a coordinated campaign of 25 crypto/web3 typosquat packages published under the single npm scope @wagnibot on 2026-07-09. Each package declares a postinstall lifecycle hook...

Malicious code in @wagni_bot/web3-agent (npm)

Source: amazon-inspector 8c0a6ae1834b7a2ba134544c33f4f3a26457a5e1ea9858a3d6c22f64bbf17c57 On npm install, postinstall.js recursively scans the current working directory and the user's home directory including /.ethereum, /.config/ethereum, /.solana, /.config/solana, /.bitcoin, /Library/Ethereum f...

Malicious code in @wagni_bot/web3-toolkit (npm)

Source: amazon-inspector 0a07053ee42572578f0fbeab5c9c8551fd2937f1126bc9c71c37546dfdf19edd The package installs a postinstall.js payload wired to both preinstall and postinstall lifecycle hooks and to main, so it runs automatically on npm install. On execution it walks the user's home directory an...