The @wagni_bot/opensea-sdk npm package is a malicious dropper that activates during post-installation. It scans the user's filesystem and environment for sensitive cryptographic keys and credentials related to Ethereum, Bitcoin, Solana wallets, SSH private keys, and secret environment variables. The harvested data is sent unencrypted to a remote attacker-controlled server at IP 107.161.90.180 on port 7777. This package impersonates the legitimate OpenSea SDK namespace but provides no actual SDK functionality, serving solely as a credential stealer. Affected versions include 1.0.0, 1.1.0 through 1.1.5, and 1.2.0.

Successful installation of this package leads to the theft of sensitive cryptographic wallet keys, SSH private keys, and secret environment variables from the developer's machine. This exposure can result in unauthorized access to cryptocurrency wallets, SSH accounts, cloud services, and other systems relying on the compromised credentials. The data exfiltration occurs silently and over unencrypted HTTP, increasing the risk of interception but primarily enabling the attacker to gain full control over the victim's sensitive assets.

No official patch or remediation is available since this is a malicious package rather than a vulnerability in legitimate software. The primary mitigation is to avoid installing the @wagni_bot/opensea-sdk package entirely. Developers should verify package authenticity before installation, prefer official SDKs from trusted sources, and audit their environment for any signs of compromise if this package was installed. Rotate any exposed credentials, including crypto wallets, SSH keys, and secret environment variables, immediately upon detection.