@wagni_bot/ethereum-wallet versions 1.0.0 and 1.2.0 include a postinstall.js script triggered by npm lifecycle hooks that recursively searches the user's home, Desktop, Documents, Downloads, /tmp, and /root directories for cryptocurrency wallet artifacts and credential files such as wallet.json, keystore.json, id.json, metamask.json, phantom.json, seed.txt, mnemonic.txt, private.key, .env, credentials.json, .npmrc, .netrc, .git-credentials, SSH private keys, AWS credentials, and browser extension local storage for MetaMask and Phantom. It also scans text and markdown files for keywords related to seed phrases and passwords in English and Spanish. The collected data (up to 10,000 bytes per file) along with hostname, username, and current working directory is sent via HTTP POST to a hardcoded IP address. The package lacks any legitimate features and is intended as a credential harvester.

Users who install these versions of the package risk having sensitive cryptocurrency wallet data and credentials stolen, potentially leading to unauthorized access to wallets and other accounts. The exfiltration of private keys and seed phrases can result in complete compromise of affected wallets. The malicious behavior occurs silently during package installation, increasing the risk of unnoticed data theft.

No official fix or patch is currently available for these versions. Users should immediately uninstall @wagni_bot/ethereum-wallet versions 1.0.0 and 1.2.0 and avoid installing this package. Review systems for signs of compromise and consider rotating any exposed credentials or wallets. Monitor for updates from the package maintainer or npm advisories for remediation. Since this is a malicious package, the best mitigation is to avoid using it entirely.