solana-web3-fixed@1.0.0

Analysis

TRUE POSITIVE: solana-web3-fixed@1.0.0 is a combosquatting Solana wallet/credential stealer. The built bundles (lib/index.cjs.js L11316-11336, lib/index.esm.js L11211-11236) contain injected malware that: (1) checks for anti-analysis by testing if external IP == 104[.]239[.]66[.]223 (attacker's own IP) or hostname matches /vps|server|host|node|instance/ to evade sandboxes; (2) steals Solana wallet keys (~/.config/solana/id.json, ~/.solana/id.json), SSH private keys (~/.ssh/id_rsa, ~/.ssh/id_ed25519), AWS credentials, and all .env files; (3) scrapes process.env for tokens containing KEY, SECRET, MNEMONIC, PRIVATE, TOKEN, PASSWORD, SOLANA, NPM, GITHUB, AWS, etc.; (4) hijacks solana CLI config to redirect RPC traffic to attacker-controlled hxxp://104[.]239[.]66[.]223:8899; (5) exfiltrates via Telegram bot (token: [redacted-credential], chat ID: 8346336575) using api[.]telegram[.]org/bot.../sendMessage. Publisher is "solana-foundations" (combosquatting Solana Foundation) with disposable email [account] — impersonating Solana Labs. No lifecycle hooks needed; the payload runs as a top-level side-effect on require().