The @wagni_bot/metemask-sdk npm package is a malicious typosquat of the legitimate metamask-sdk package. It contains no functional code but includes a postinstall script that executes automatically during npm install. This script recursively searches common directories and environment variables for sensitive credentials such as SSH private keys, crypto wallet seeds, and secret environment variables. The stolen data is then exfiltrated to an attacker-controlled Telegram channel. This threat targets developers who mistakenly install this similarly named package.