If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (9b539591552f3e960f65ceb70d946bc56f240f9bdb1400c501723aa32fd305ec)
Package name @solana-js/web3 impersonates the legitimate @solana/web3.js SDK, and package.json falsely attributes authorship to 'Solana Labs' with a solana.com homepage. The exported API is a non-functional stub (Connection.getBalance returns 0, sendTransaction returns random bytes) — no real Solana client functionality is present. On install, scripts/postinstall.js detects Windows and spawns a hidden PowerShell (`-NoP -W Hidden -Exec Bypass`) with a base64-encoded command. The decoded PowerShell performs an AMSI bypass via reflection over System.Management.Automation.AmsiUtils, downloads a binary payload from https://files.catbox.moe/a3loxy.bin, and executes it in-process using VirtualAlloc/CreateThread. The postinstall script further hex-escapes API names ('child_process', 'powershell', 'platform', 'win32') and fragments the PowerShell payload to hinder review. The result is arbitrary remote code execution on any Windows host that runs `npm install` against this package, with the shellcode fetched from an anonymous, mutable file host (files.catbox.moe) — a known-bad-infrastructure dropper pattern.