Malicious code in @devmikets/hyperliquid-sdk (npm)

Source: amazon-inspector c401f279d5ea91e416e18e54888c22d1087a44449aa9629dfb86f3c5945ec903 package.json declares inquirer with a tarball URL pointing at registrynpmjs.to — a domain that typosquats the official npm registry registry.npmjs.org. Running npm install fetches and installs whatever tarba...

Malicious code in @devmikets/hyperliquid-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c401f279d5ea91e416e18e54888c22d1087a44449aa9629dfb86f3c5945ec903 package.json declares inquirer with a tarball URL pointing at registrynpmjs.to — a domain that typosquats the official npm registry registry.npmjs.or...

MAL-2026-14042 Malicious code in @devmikets/hyperliquid-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c401f279d5ea91e416e18e54888c22d1087a44449aa9629dfb86f3c5945ec903 package.json declares inquirer with a tarball URL pointing at registrynpmjs.to — a domain that typosquats the official npm registry registry.npmjs.or...

Malicious code in @wagni_bot/hyperliquid-sdk (npm)

Source: amazon-inspector ca6ec83c9621f8afc9616d49876cc451ca8d99397d99288889b81298eb410d7e The package is scoped and named to impersonate the Hyperliquid exchange SDK @wagnibot/hyperliquid-sdk but ships no SDK code — only a harvester in postinstall.js that is wired to run automatically on npm...

Malicious Package

Overview @wagnibot/hyperliquid-sdk is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...