The solana-wallet-utils package version 1.0.0 on PyPI contains malicious code that masquerades as a cryptocurrency utility but exfiltrates private keys or seed phrases provided by users. This malware is part of a campaign identified as 2026-05-solana-wallet-sdk, characterized by crypto-related data exfiltration.