solana-web3-lts@1.0.0

Analysis

solana-web3-lts@1.0.0 is a combosquat of @solana/web3.js carrying a full credential-stealer and remote-access trojan. The bundles embed a Telegram-based C2 backdoor (chat id 8346336575) that steals Solana wallet keys (~/.config/solana/id.json), SSH keys, AWS credentials and .env secrets; exfiltrates environment variables matching KEY/SECRET/MNEMONIC/TOKEN/PASSWORD/AWS/NPM/GITHUB/SOLANA; rewrites the Solana CLI config.yml to redirect RPC through 104[.]239[.]66[.]223:8899; installs crontab persistence; and enables a remote shell via Telegram commands (/keys, /ssh, /env, /sh, /die). It skips execution if the host's public IP matches 104[.]239[.]66[.]223. The burner publisher account impersonates Solana Labs.