The @wagni_bot/binance-sdk npm package is a malicious package masquerading as a Binance SDK. Instead of providing SDK functionality, it executes a postinstall script that searches the user's home directory for cryptocurrency wallet files, AWS credentials, SSH keys, git credentials, npm tokens, and environment secrets. It then exfiltrates this sensitive data along with system hostname and user information to a hardcoded attacker-controlled IP address. This affects developers or CI systems that run npm install on the affected versions of this package.