The npm package @wagni_bot/polymarket-sdk is a malicious credential-stealing package masquerading as a legitimate Polymarket SDK. It exports no functional code but runs a post-install script that searches for cryptocurrency wallet keys, SSH private keys, and sensitive environment variables on the victim's system. The stolen data is exfiltrated over unencrypted HTTP to a hardcoded IP address. Multiple versions of this package are affected.