MAL-2026-4709

    Dashboard / Malicious Package / MAL-2026-4709

    MAL-2026-4709

    Published: 20 May 2026Last Modified: 27 May 2026

    Summary: Malicious code in wallet-agent-ai-radix (npm)

    Details: Source: amazon-inspector (60a953d7785091650f4f48e0b038e71ad79788102ffd652bff4bb0e8bf40ea21) dist/agent.js contains a hardcoded Telegram Bot API endpoint (https://api.telegram.org) reached via fetch() with a POST body that includes values from process.env. The bundle co-references wallet-related endpoints (api.astrolescent.com) alongside the Telegram exfiltration channel. A package whose advertised purpose is wallet/agent functionality has no legitimate reason to POST environment data or wallet context to a hardcoded third-party Telegram bot — this is the canonical hardcoded-C2 exfiltration shape, where any installer/operator running this package leaks data to the attacker who controls the embedded bot token.

    References: https://www.npmjs.com/package/wallet-agent-ai-radix/v/1.0.0

    Affected packages

    Package

    Name: wallet-agent-ai-radix

    Purl: pkg:npm/wallet-agent-ai-radix

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0