The dlmm-sdk package on PyPI version 1.0.0 contains malicious code that exfiltrates sensitive environment variables and credential files upon import and installation. It collects secrets related to cloud providers, cryptocurrencies, package registries, and configuration files such as SSH keys and cloud CLI settings. The stolen data is sent to a hardcoded external webhook endpoint. This behavior is disguised as environment diagnostics but is in fact unauthorized data theft.