mjs-biginteger@5.0.6

Analysis

index.js is a blockchain dead-drop loader that runs on import. It POSTs a Solana JSON-RPC getAccountInfo request to hxxps://api[.]devnet[.]solana[.]com for account 4WF8QCFEnVD7BLs3QAVe2SjxRZ4n3EboCsdhj363VAqZ (encoding base64, commitment processed), then parses the returned account data as a length-prefixed blob: it reads a uint32 length at byte offset 32 and slices the UTF-8 payload from offset 36 for that length. The extracted string is executed as JavaScript via new Function("require","module","exports", code)(require, module, module.exports), giving the attacker remote code execution with the payload stored (and updatable) on-chain. IOCs: Solana devnet RPC endpoint api[.]devnet[.]solana[.]com and dead-drop account 4WF8QCFEnVD7BLs3QAVe2SjxRZ4n3EboCsdhj363VAqZ.