The npm package @wagni_bot/ethereum-wallet versions 1.0.0 and 1.2.0 contains malicious code that executes during installation. It scans common user directories for cryptocurrency wallet files, credentials, and sensitive key files, then exfiltrates truncated contents along with system information to a hardcoded external server. The package has no legitimate functionality and is designed to masquerade as a wallet utility to deceive developers.