The web3-connect package version 1.0.0 on PyPI contains malicious code that masquerades as a crypto utility but actually exfiltrates private keys or seeds provided to it. This malware campaign, identified as 2026-05-solana-wallet-sdk, is designed to steal sensitive cryptographic credentials from users.