new-solt@0.0.7

Analysis

new-solt@0.0.7 is a crypto-credential theft implant disguised as a Solana-adjacent package. When required and run (or when npm test is executed), it performs full filesystem scanning across the victim's home directories and mounted drives for cryptocurrency wallet files, including: .env files, Solana id.json keypair files, and files with names matching wallet/key/seed/mnemonic/keystore/phantom/metamask patterns. It also steals shell history (bash, zsh, fish, PowerShell) to recover previously typed credentials, and exfiltrates the Telegram Desktop tdata session folder (enabling account takeover). All stolen data is uploaded via HTTP multipart POST to hxxps://vercel-backend-rn1xzfazn-djbdhdfjjt5-2167s-projects[.]vercel[.]app/api/v1. The package additionally depends on the known-malicious child_process npm package, providing a secondary attack vector.