The npm package @wagni_bot/eth-agent is a malicious supply-chain credential stealer disguised as an Ethereum SDK. It executes a postinstall script on npm install that collects sensitive files such as SSH private keys, cryptocurrency wallet files, and environment variables containing secrets. The stolen data is exfiltrated to a hardcoded Telegram bot endpoint. This package is part of a coordinated campaign involving 25 similarly malicious packages under the @wagni_bot scope, all sharing identical payloads and exfiltration methods. The packages were live on npm as of 2026-07-09 and had not yet been cataloged in major vulnerability databases at that time.