@wagni_bot/jupiter-sdk versions 1.0.0 and 1.2.0 is a malicious npm package that impersonates the Jupiter SDK namespace for Solana decentralized exchange development. Upon installation, its postinstall.js script automatically runs and searches the installer's home directory and common locations for wallet files related to Solana and Ethereum, browser extension states for MetaMask and Phantom, seed phrases and mnemonics identified by keyword and BIP39 wordlist matching, and various credential files including .env, .npmrc, .git-credentials, .netrc, AWS credentials, and SSH private keys. It collects up to 5000 bytes of each matched file and gathers host identity information such as hostname, user info, and home directory. All collected data is sent via HTTP POST to a hardcoded external server at 107.161.90.180 on port 7777. The package lacks any legitimate code or documentation and is purely designed as a credential stealer leveraging namespace impersonation to deceive developers.

This malicious package compromises the confidentiality of sensitive cryptographic wallet materials and credentials by exfiltrating them to an attacker-controlled server. This can lead to theft of cryptocurrency assets, unauthorized access to cloud and development environments, and broader compromise of developer systems. The attack occurs silently during npm install, increasing the risk of unnoticed credential theft.

No official patch or remediation is available for this malicious package. The best mitigation is to avoid installing @wagni_bot/jupiter-sdk versions 1.0.0 and 1.2.0. Developers should verify package authenticity before installation, prefer official SDK sources, and audit dependencies for typosquatting or suspicious packages. Remove any instances of these versions if found in projects and rotate any potentially compromised credentials or wallet keys. Monitor for suspicious network activity to the indicated C2 server IP and block it if possible.