The web3-tool-sdk package version 1.0.0 on PyPI contains malicious code that automatically scans the filesystem for BIP-39 seed phrases and private key data, then exfiltrates this sensitive information. This behavior classifies it as malware with clear intent to steal cryptocurrency-related secrets.