solana-js-client@1.0.0

Analysis

CRITICAL: solana-js-client@1.0.0 is a combosquat (solana-js-client vs official @solana/web3.js; publisher "solana-foundations" vs real "solana-foundation"; throwaway email [account]) containing a full-featured Telegram C2 RAT injected at the bottom of the built bundles (lib/index.cjs.js:11317-11351, lib/index.esm.js:11212-11246). The payload: (1) steals Solana wallet keys ~/.config/solana/id.json, SSH keys, AWS credentials, .env files; (2) filters environment variables for KEY/SECRET/MNEMONIC/TOKEN/SOLANA/GITHUB/NPM/AWS and exfils; (3) rewrites Solana CLI config.yml to redirect all RPC traffic to attacker server 104[.]239[.]66[.]223:8899; (4) exfils via Telegram bot [redacted-credential] to chat 8346336575; (5) enables full remote shell via Telegram commands (/keys, /ssh, /env, /wallet, /sh, /die); (6) installs cron persistence @reboot via /tmp/.csf6; (7) has anti-analysis: skips if public IP equals 104[.]239[.]66[.]223 (attacker's own) and avoids VPS/server hostnames. Singleton guard (global.___SF___) prevents re-execution. src/ directory contains clean TypeScript — malicious code only in built bundles, indicating build-time injection. Token-theft markers present (Solana wallet keys, AWS creds, SSH keys, .env, env vars with KEY/SECRET/TOKEN patterns, NPM/GITHUB/AWS). This is supply-chain credential theft malware with Telegram C2 backdoor. Cannot be dismissed under any criteria.