The @wagni_bot/solana-sdk npm package is a malicious package designed to harvest credentials from developers who mistakenly install it, believing it to be a legitimate Solana SDK. Its main entry point runs a postinstall script that recursively scans the installer's home directory, Desktop, Documents, Downloads, /root, and /tmp for files containing wallet keys (e.g., id.json, wallet.json, keypair.json), browser extension storage for MetaMask and Phantom, environment files (.env), mnemonic and seed files, SSH private keys, AWS credentials, git credentials, and other sensitive configuration files. It collects up to 10KB of each file's content along with system information such as hostname and username, then transmits this data unencrypted to a remote IP address (http://107.161.90.180:7777). The package uses typosquatting to trick developers into installing it.

Successful installation of this package results in the exfiltration of sensitive credentials and private keys from the developer's environment, potentially compromising wallets, cloud accounts, SSH access, and other critical resources. The data is sent in cleartext to an attacker-controlled server, increasing the risk of interception. This can lead to account takeovers, financial theft, and further compromise of development and production environments.

No official patch or fix is available for this malicious package. The primary mitigation is to avoid installing @wagni_bot/solana-sdk and verify package authenticity before installation. Use trusted package sources and verify package names carefully to avoid typosquatting. Remove any installations of this package immediately and investigate for potential credential compromise. Rotate any credentials or keys that may have been exposed. Monitor for suspicious activity related to compromised credentials.