The npm package 'uniswap-sdk-v4' version 1.0.0 is a malicious typosquat of the legitimate Uniswap SDK. It contains code that captures the private key supplied to its WalletClient constructor and sends it to a hardcoded third-party webhook, resulting in full wallet compromise upon instantiation. The destination webhook URL is fixed and not configurable by the user.