solana-rpc-client@1.0.0

Analysis

solana-rpc-client@1.0.0 is a combosquat of @solana/web3.js with a credential-stealer payload injected into its main entry points (lib/index.cjs.js, lib/index.esm.js). The code reads Solana wallet keys (~/.config/solana/id.json, ~/.solana/id.json), SSH keys (~/.ssh/id_rsa), AWS credentials and .env files; scans environment variables for tokens (SOLANA, NPM, GITHUB, AWS, ALCHEMY, INFURA and others); overwrites the Solana CLI config to redirect RPC traffic to 104[.]239[.]66[.]223:8899; exfiltrates to a hardcoded Telegram bot; installs @reboot cron persistence; and runs a Telegram-based C2 supporting /keys, /ssh, /env, /wallet, /sh and /die commands. It skips execution when the host's public IP matches 104[.]239[.]66[.]223.