Malicious code in @wagni_bot/meteora-sdk (npm)
The npm package @wagni_bot/meteora-sdk versions 1.0.0 and 1.2.0 contains malicious code that executes during installation and runtime. It scans user directories for sensitive wallet, keystore, seed phrase files, and credential files related to cryptocurrency wallets and cloud services. The harvested data, including file contents and system information, is exfiltrated to a remote server. The package impersonates the legitimate Meteora Solana SDK namespace but contains no legitimate SDK code, serving solely as a data harvester.
AI Analysis
Technical Summary
The @wagni_bot/meteora-sdk npm package (versions 1.0.0 and 1.2.0) includes a postinstall.js script that runs at preinstall, postinstall, and on require(). This script searches user home directories and common locations for cryptocurrency wallet files, seed phrases, environment files, AWS credentials, SSH keys, Git credentials, and browser extension storage related to MetaMask and Phantom wallets. It scans text-based files for BIP39 seed phrase keywords in English and Spanish. All collected data, along with hostname, username, and current working directory, is sent to a remote IP address (http://107.161.90.180:7777). The package is a malicious impersonation of the Meteora Solana SDK namespace and does not provide any legitimate SDK functionality.
Potential Impact
Sensitive cryptographic wallet files, seed phrases, and credential files are exposed and exfiltrated to an attacker-controlled server, potentially leading to theft of cryptocurrency assets and unauthorized access to cloud and version control services. The malicious code executes automatically on installation and when the package is required, increasing the risk of compromise for users who install or depend on these specific package versions.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should immediately avoid installing or using @wagni_bot/meteora-sdk versions 1.0.0 and 1.2.0. Remove these package versions from any systems where they are installed. Monitor for any unauthorized access to cryptocurrency wallets or cloud accounts. Check vendor advisories or npm security advisories for updates or official fixes. Since this is not a cloud service, remediation depends on user action.
Malicious code in @wagni_bot/meteora-sdk (npm)
Description
The npm package @wagni_bot/meteora-sdk versions 1.0.0 and 1.2.0 contains malicious code that executes during installation and runtime. It scans user directories for sensitive wallet, keystore, seed phrase files, and credential files related to cryptocurrency wallets and cloud services. The harvested data, including file contents and system information, is exfiltrated to a remote server. The package impersonates the legitimate Meteora Solana SDK namespace but contains no legitimate SDK code, serving solely as a data harvester.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The @wagni_bot/meteora-sdk npm package (versions 1.0.0 and 1.2.0) includes a postinstall.js script that runs at preinstall, postinstall, and on require(). This script searches user home directories and common locations for cryptocurrency wallet files, seed phrases, environment files, AWS credentials, SSH keys, Git credentials, and browser extension storage related to MetaMask and Phantom wallets. It scans text-based files for BIP39 seed phrase keywords in English and Spanish. All collected data, along with hostname, username, and current working directory, is sent to a remote IP address (http://107.161.90.180:7777). The package is a malicious impersonation of the Meteora Solana SDK namespace and does not provide any legitimate SDK functionality.
Potential Impact
Sensitive cryptographic wallet files, seed phrases, and credential files are exposed and exfiltrated to an attacker-controlled server, potentially leading to theft of cryptocurrency assets and unauthorized access to cloud and version control services. The malicious code executes automatically on installation and when the package is required, increasing the risk of compromise for users who install or depend on these specific package versions.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should immediately avoid installing or using @wagni_bot/meteora-sdk versions 1.0.0 and 1.2.0. Remove these package versions from any systems where they are installed. Monitor for any unauthorized access to cryptocurrency wallets or cloud accounts. Check vendor advisories or npm security advisories for updates or official fixes. Since this is not a cloud service, remediation depends on user action.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-10029
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a50baa368715ace43584e5e
Added to database: 07/10/2026, 09:25:55 UTC
Last enriched: 07/10/2026, 10:13:17 UTC
Last updated: 07/27/2026, 00:16:00 UTC
Views: 29
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.