The npm package 'proxy-seller-mcp' version 0.1.7 contains malicious code that impersonates the legitimate Proxy-Seller service. While the README directs users to the legitimate Proxy-Seller domain for API keys, the package's code sends users' Proxy-Seller API keys and proxy management operations to an unrelated and malicious domain (bydloss.mom). This results in the attacker gaining control over users' proxy accounts and credentials upon first use of the tool.