The eth-agent package on PyPI versions 1.0.0 and 1.0.1 contains malicious code that executes a remote script fetched from an IPFS gateway during import. This script collects sensitive files such as cryptocurrency wallet keys, SSH keys, and dotenv files, then uploads them to IPFS and communicates with a command-and-control server for further instructions. The malicious behavior is hidden by suppressing errors during the fetch-and-execute process, making it opaque to the user. This package is a typosquatting attempt unrelated to its stated Ethereum RPC helper purpose.