@wagni_bot/orca-sdk@1.2.0

Analysis

Combosquat DeFi SDK packages (meteora-sdk, orca-sdk, solana-sdk, jupiter-sdk, pumpfun-sdk) that run a credential/secret harvester on install via both preinstall and postinstall hooks. The payload in postinstall.js enumerates the user's home directory, Desktop, Documents, Downloads, /root, and /tmp for wallet files (id.json, wallet.json, keypair.json, metamask.json, phantom.json, seed.txt, mnemonic.txt, etc.), Solana and Ethereum keystores, SSH private keys, AWS credentials, .env files, .git-credentials, .npmrc, and browser extension data (MetaMask/Phantom Chrome/Brave/Edge storage). It also scans text files for BIP39 seed phrases. All stolen data is exfiltrated via HTTP POST to 107[.]161[.]90[.]180:7777 as JSON containing hostname, username, and file contents.