@wagni_bot/meteora-sdk @1.2.0
Vulnerability report · Last retrieved from osv.dev July 9, 2026 at 6:28 PM UTC
OSV ID
MAL-2026-10029
Ecosystem
npm
Summary
The package ships a single file postinstall.js that is wired to run at both preinstall and postinstall (and is also the package main, so require() triggers it). On install it walks user home directories, Desktop/Documents/Downloads, and /root looking for wallet/keystore/seed files,.env, ~/.aws/credentials, ~/.ssh/id_*, ~/.git-credentials, Solana id.json, Ethereum keystore JSON, and Chrome/Brave/Edge MetaMask/Phantom extension storage, and POSTs the file bytes together with hostname, username, and cwd to http://107.161.90.180:7777. It additionally scans.txt/.md/.rtf/.csv files for BIP39 wordlist matches and Spanish/English seed-phrase keywords ('seed','mnemonic','semilla','frase','clave privada', etc.) and uploads any matches to the same endpoint. The package name impersonates the Meteora Solana SDK namespace (@meteora-ag/*) but ships no SDK code — the harvester is the entire package.
Source: amazon-inspector (3c9ce73824df41724095566c21d7ff98309575f9fc77c330606559bf5d194ab5)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.