solana-token-api@1.0.0

Analysis

solana-token-api@1.0.0 is a combosquat package impersonating the Solana ecosystem. The postinstall hook runs an obfuscated JavaScript payload (main.js) that downloads a zip archive from external URLs, extracts it using adm-zip, and executes a Python script (exec.py) via pythonw.exe (Windows headless Python). The payload sets the environment variable REALTEKAUDIO to the C2 endpoint hxxps://postprocesser[.]com/[.]well-known/pki-validation/go/cinnamonroll[.]php?id=mumu before launching the script. The C2 path masquerades as SSL certificate validation traffic. The package includes a benign-looking cover module (solana-token-api.js) that fetches legitimate Solana token metadata, while the actual payload runs in the background during npm install.