MAL-2026-13941

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (9b539591552f3e960f65ceb70d946bc56f240f9bdb1400c501723aa32fd305ec) Package name @solana-js/web3 impersonates the legitimate @solana/web3.js SDK, and package.json falsely attributes authorship to 'Solana Labs' with a solana.com homepage. The exported API is a non-functional stub (Connection.getBalance returns 0, sendTransaction returns random bytes) — no real Solana client functionality is present. On install, scripts/postinstall.js detects Windows and spawns a hidden PowerShell (`-NoP -W Hidden -Exec Bypass`) with a base64-encoded command. The decoded PowerShell performs an AMSI bypass via reflection over System.Management.Automation.AmsiUtils, downloads a binary payload from https://files.catbox.moe/a3loxy.bin, and executes it in-process using VirtualAlloc/CreateThread. The postinstall script further hex-escapes API names ('child_process', 'powershell', 'platform', 'win32') and fragments the PowerShell payload to hinder review. The result is arbitrary remote code execution on any Windows host that runs `npm install` against this package, with the shellcode fetched from an anonymous, mutable file host (files.catbox.moe) — a known-bad-infrastructure dropper pattern.