The npm package @wagni_bot/solana-sdk is a malicious typosquatting package impersonating a legitimate Solana SDK. It contains no actual SDK functionality but instead executes a credential-harvesting script automatically during installation. This script searches common user directories and configuration files for sensitive wallet, SSH, AWS, git, and other credential files, collects their contents, and sends them in cleartext to a remote server. The affected versions are 1.0.0 and 1.2.0.