solana-web3-community@1.0.1

Analysis

solana-web3-community@1.0.1 is a combosquat of @solana/web3.js carrying a credential-stealer and remote-access trojan. A repeated malicious IIFE in index.cjs.js and index.esm.js harvests .env, .npmrc, SSH keys, Solana keypairs, AWS credentials and Docker configs; scans environment variables for KEY/SECRET/TOKEN/MNEMONIC/NPM/GITHUB/SOLANA; rewrites ~/.config/solana/cli/config.yml to redirect RPC traffic to hxxp://104[.]239[.]66[.]223:8899; exfiltrates the loot to a hardcoded Telegram bot (chat id 8870595195); installs an @reboot cron job for persistence; and runs a C2 polling loop supporting /keys, /ssh, /env, /wallet, /sh and /die commands. It skips execution if the host's public IP matches 104[.]239[.]66[.]223 (its own infrastructure) and embeds a taunt comment claiming no XOR, base64 or pattern detection.