The metemask-sdk package on PyPI is a malicious typosquat of the legitimate metamask-sdk. Upon import, it fetches and executes attacker-controlled code from IPFS without integrity checks, enabling arbitrary remote code execution. The package's advertised API is non-functional and serves as a facade. The malicious code steals sensitive files such as cryptocurrency wallet keys, SSH keys, and dotenv files, uploading them to IPFS, and communicates with a command-and-control server for further instructions.