The npm package 'secrets-manager-wrapper' at version 50.50.50 contains malicious code deployed via a dependency confusion and typosquatting campaign by the threat actor 'saif777'. The package uses inflated version numbers to override private registry versions and executes a postinstall hook that collects system fingerprint data including public IP, username, hostname, CPU model, RAM, working directory, and OS platform. This data is exfiltrated to a Discord webhook. The payload includes sandbox and bot detection to differentiate real machines from analysis environments. Systems with this package installed should be considered fully compromised.