The npm package gekko-mev-bot version 1.0.0 contains malicious code that masquerades as an Ethereum MEV bot. It runs a hidden background process that collects sensitive data from the user's system, including crypto wallet extension storage, browser cookies and login data, Discord tokens, Telegram data, and files matching wallet-related keywords. This data is exfiltrated to a Cloudflare Workers endpoint impersonating MetaMask. The background process retries data exfiltration every 30 seconds if it fails.