The npm package pumpswap-sdk-v1 version 0.0.1 contains malicious code that exfiltrates data by base64-encoding inputs and sending them to a remote server. It also sends cryptographic random bytes to the same server. This behavior occurs on the first call to the package functions, not on install or import. The package is considered fully compromising any system it is installed on, requiring immediate secret and key rotation and removal of the package. Complete system compromise is possible, and removing the package alone may not eliminate all malicious software.