The @wagni_bot/eth-agent npm package versions 1.0.0, 1.1.0 through 1.1.5, and 1.2.0 contain malicious code that runs during the postinstall lifecycle event. The code searches for private keys (.pem, .key, id_rsa, id_ed25519), credential files (.cred, .env), SSH keys in ~/.ssh, and environment variables with names indicating secrets (e.g., PRIVATE, SECRET, TOKEN, API_KEY, PASSWORD, MNEMONIC, SEED, WALLET, AWS). It then sends the collected data along with hostname, username, and current working directory to a hardcoded IP address via plain HTTP without encryption or authentication. The package exports an empty module, indicating its sole purpose is data theft targeting developers working with Ethereum tooling.

Successful installation of any affected version leads to immediate exfiltration of sensitive credentials including SSH private keys, environment secrets, and credential files from the installer's machine. This compromises the confidentiality of the user's cryptographic keys and secrets, potentially enabling unauthorized access to systems, cloud services, and cryptocurrency wallets.

No official patch or remediation is currently available. Users should avoid installing the @wagni_bot/eth-agent package in any version listed as affected. Remove any instances of this package from projects and scan systems for potential credential exposure. Rotate any potentially compromised keys and secrets immediately. Monitor for suspicious activity related to exposed credentials. Patch status is not yet confirmed — check the vendor advisory or trusted sources for updates.