MAL-2026-10028 Malicious code in @wagni_bot/metemask-sdk (npm)

The npm package @wagnibot/metemask-sdk is a supply-chain credential stealer disguised as a MetaMask misspelled 'metemask' SDK. It is one member of a coordinated campaign of 25 crypto/web3 typosquat packages published under the single npm scope @wagnibot on 2026-07-09. Each package declares a...

Malicious code in strapi-plugin-server (npm)

strapi-plugin-server is a malicious npm package disguised as a Strapi CMS plugin. On install, it runs a postinstall script that executes an 11-phase attack: stealing .env files, environment variables, Strapi configuration, private keys, Redis data, Docker/Kubernetes secrets, and network topology...