The wallet-monitor-snap package for MetaMask contains malicious code that tricks users into revealing their Secret Recovery Phrase. It presents a fake security alert within MetaMask's trusted UI, prompting users to enter their seed phrase, which is then captured and sent to any invoking decentralized application. The package uses benign RPC methods as a cover to appear legitimate during store review. This compromises any HD wallet accounts derived from the stolen phrase, giving full control to the attacker.