The npm package 'web3-tools-9' version 1.0.0 contains malicious code that acts as a crypto/SSH/wallet stealer. It automatically executes postinstall scripts that harvest sensitive data including SSH private keys (~/.ssh/id_rsa), wallet keys, seeds, and environment variables. The stolen data is exfiltrated to a hardcoded Telegram bot. This package is part of a campaign using generic web3-related names with numeric suffixes. The malicious behavior was confirmed by multiple sources including Amazon Inspector and the OpenSSF Package Analysis project.