unique-new-york-standard-wallet@1.0.4

Analysis

This package impersonates a Solana wallet provider. It ships both an npm library and a browser/Safari extension bundle that inject a fake wallet (RealGhost) into web pages and register it as a Solana wallet-standard provider. On load it begins polling a hardcoded remote command-and-control endpoint (an ngrok tunnel) once per second and executes commands returned by the server. It also POSTs page telemetry (current URL, scroll position, version) to the same C2. Wallet signing methods (signTransaction, signAndSendTransaction, signAllTransactions) serialize transactions to base64 and route them through a content-script bridge controlled by the attacker, and a hardcoded attacker public key is returned to the page on connection. The hardcoded developer tunnels, empty package metadata, and remote-command execution show this is a wallet-hijacking harness rather than a legitimate wallet integration.