The @wagni_bot/polygon-sdk npm package contains malicious code that executes during installation. The postinstall.js script scans the installer's current working directory and home directory for sensitive files related to cryptocurrency wallets and private keys, including ~/.ssh, ~/.ethereum, ~/.config/ethereum, ~/.solana, ~/.bitcoin, and ~/Library/Ethereum. It looks for files matching patterns such as seed, mnemonic, keystore, wallet, secret, and private, and extracts up to 10,000 bytes of their content. Additionally, it collects environment variables containing keywords like PRIVATE, SECRET, TOKEN, KEY, PASSWORD, MNEMONIC, SEED, WALLET, or AWS. All this data, along with the host's OS hostname, username, and current working directory, is sent via HTTP POST to a hardcoded bare-IP endpoint (http://107.161.90.180:7777). The package exports an empty object and provides no legitimate functionality, indicating its sole purpose is credential theft. It masquerades as an unofficial Polygon SDK to target crypto developers likely to have valuable wallet credentials.

Users who install this package risk having sensitive wallet credentials, private keys, seed phrases, and secret environment variables stolen and sent to an attacker-controlled server. This can lead to compromise of cryptocurrency wallets and other accounts relying on these secrets. The package does not provide legitimate functionality and is purely malicious.

No official patch or remediation is available for this malicious package. The best mitigation is to avoid installing @wagni_bot/polygon-sdk entirely. Users who have installed this package should immediately remove it and investigate for potential credential compromise. Rotate any exposed keys, wallets, or secrets that may have been compromised. Use only trusted and verified packages from official sources. Monitor for suspicious activity related to any potentially leaked credentials.