Malicious Package

Overview @wagnibot/orca-sdk is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-10031 Malicious code in @wagni_bot/orca-sdk (npm)

The npm package @wagnibot/orca-sdk is a supply-chain credential stealer disguised as a Orca Solana DEX SDK. It is one member of a coordinated campaign of 25 crypto/web3 typosquat packages published under the single npm scope @wagnibot on 2026-07-09. Each package declares a postinstall lifecycle...

orca-sdk (>=0.0.78, <=0.1.1) potentially affected by CVE-2026-49119 via gradio (5.13.0)

gradio PYPI version 5.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - orca-sdk =0.0.78, =0.1.1 Source cves: CVE-2026-49119 Source advisory: OSV:GHSA-J36P-7W88-G82J...

orca-sdk (>=0.0.78, <=0.1.1) potentially affected by CVE-2026-49119 via gradio (5.13.0)

gradio PYPI version 5.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - orca-sdk =0.0.78, =0.1.1 Source cves: CVE-2026-49119 Source advisory: OSV:PYSEC-2026-2179...

orca-sdk (>=0.0.78, <=0.1.1) potentially affected by CVE-2026-10783 via gradio (5.13.0)

gradio PYPI version 5.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - orca-sdk =0.0.78, =0.1.1 Source cves: CVE-2026-10783 Source advisory: OSV:PYSEC-2026-211...