The npm package @wagni_bot/meteora-sdk versions 1.0.0 and 1.2.0 contains malicious code that executes during installation and runtime. It scans user directories for sensitive wallet, keystore, seed phrase files, and credential files related to cryptocurrency wallets and cloud services. The harvested data, including file contents and system information, is exfiltrated to a remote server. The package impersonates the legitimate Meteora Solana SDK namespace but contains no legitimate SDK code, serving solely as a data harvester.