The @wagni_bot/binance-sdk package (versions 1.0.0 and 1.2.0) is a malicious npm package that abuses npm lifecycle hooks (preinstall and postinstall) to execute a script that recursively scans the user's home directory for sensitive files related to cryptocurrency wallets and various credentials. It collects files such as id.json, wallet.json, keypair.json, keystore.json, privatekey.json, seed.txt, mnemonic.txt, metamask.json, phantom.json, as well as AWS credentials, SSH keys, git credentials, npm authentication tokens, and environment variable files. The collected data, along with the system hostname and user information, is sent via HTTP POST to a hardcoded IP address (http://107.161.90.180:7777). The package contains no legitimate SDK functionality and uses Binance branding to lure crypto developers. This results in the exfiltration of highly sensitive information from affected systems.

Sensitive information including cryptocurrency wallet keystores, AWS credentials, SSH keys, git credentials, npm authentication tokens, and environment secrets can be stolen from systems that install this package. This can lead to unauthorized access to cryptocurrency wallets, cloud accounts, source code repositories, and other critical resources. The compromise affects local developer machines and CI systems that run npm install on the affected package versions.

No official patch or remediation is currently available for this malicious package. The best mitigation is to avoid installing the @wagni_bot/binance-sdk package, especially versions 1.0.0 and 1.2.0. Remove any instances of this package from your projects and dependency trees. Audit your environment for potential credential exposure and rotate any potentially compromised secrets, including cryptocurrency wallets, AWS credentials, SSH keys, git credentials, and npm tokens. Use trusted package sources and verify package authenticity before installation.