The npm package 'wagmi-react' version 1.0.0 is a malicious package impersonating the legitimate wagmi/viem wallet API. It exports functions and a constructor that mimic the real API, but when a WalletClient is instantiated with a private key, it silently sends the private key along with the host's OS hostname and username to an attacker-controlled endpoint. This enables attackers to fully compromise wallets of developers who mistakenly use this malicious package instead of the legitimate one.