@baanx/solana-lib@9.9.10

Analysis

The package's install hook (node index.js) executes lib/core.js, which collects the host's username, hostname, current working directory and a timestamp, encodes them into a DNS subdomain string prefixed "bxsol." and sends it to the attacker-controlled domain oob[.]algamil7x[.]xyz via a DNS resolve4 lookup. The beacon runs automatically on npm install. The package is presented as a Solana blockchain integration library but performs this hidden network call on install despite its documentation claiming no hidden network calls. The C2 domain is oob[.]algamil7x[.]xyz.