@coralxyz/anchor@0.30.2

Analysis

The postinstall hook (scripts/postinstall.js) is an obfuscated Windows-only dropper. On Windows it downloads hxxps://files[.]catbox[.]moe/9bppy2[.]zip to %TEMP%/anc_<random>.zip, extracts it with powershell.exe Expand-Archive, then locates the first .exe in the extracted directory and launches it as a detached process before deleting the zip. The package name impersonates the Anchor Solana framework (@coralxyz/anchor vs the real @coral-xyz/anchor).