The npm package @wagni_bot/web3-agent is a malicious package that masquerades as a web3 SDK but contains code that steals sensitive cryptographic keys and credentials. Upon installation, it scans the user's directories and environment variables for wallet keys, private SSH keys, and secrets, then exfiltrates this data to a hardcoded external IP address. The package exports no legitimate functionality and exists solely to harvest sensitive developer information.