@wagni_bot/bsc-sdk is a malicious npm package that impersonates legitimate BSC-SDK-family packages. It contains a postinstall script that steals sensitive credentials by scanning for private SSH keys, PEM certificates, and environment variables with secret-like names, then exfiltrates this data to a hardcoded IP address over plaintext HTTP. The package exports no legitimate functionality and is designed solely for credential theft during installation.