Malicious code in @wagni_bot/eth-agent (npm)

Source: amazon-inspector 08c234c984ea87a7d4c780dc8ddbc244926628e405ea0f7ac9798309260a6122 The package advertises itself as an 'Unofficial eth-agent SDK' but ships an empty main module index.js contains only module.exports = ; its sole runtime behavior is a postinstall lifecycle script that fires...

Malicious code in eth-agent (PyPI)

Source: amazon-inspector 3131490d64c4ae90de2926ca90f6fce23e6a113d1e6538db5ce98ffcf06983d1 The top-level ethagent/init.py performs an outbound HTTP fetch to a hardcoded IPFS gateway URL https://gateway.pinata.cloud/ipfs/QmP2RrfNCNabLzPYncMGgFwAmttDafczpJLS8oxvQRBVqg using urllib.request.urlopen,...

MAL-2026-10195 Malicious code in eth-agent (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3131490d64c4ae90de2926ca90f6fce23e6a113d1e6538db5ce98ffcf06983d1 The top-level ethagent/init.py performs an outbound HTTP fetch to a hardcoded IPFS gateway URL...

Malicious code in eth-agent (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3131490d64c4ae90de2926ca90f6fce23e6a113d1e6538db5ce98ffcf06983d1 The top-level ethagent/init.py performs an outbound HTTP fetch to a hardcoded IPFS gateway URL...

MAL-2026-10024 Malicious code in @wagni_bot/eth-agent (npm)

The npm package @wagnibot/eth-agent is a supply-chain credential stealer disguised as a Ethereum SDK. It is one member of a coordinated campaign of 25 crypto/web3 typosquat packages published under the single npm scope @wagnibot on 2026-07-09. Each package declares a postinstall lifecycle hook...