The @merceas/anchor package is a malicious typosquat of the legitimate @coral-xyz/anchor SDK. Its package.json overrides the standard cross-fetch dependency with an npm alias pointing to a malicious fork under the @merceas scope. This causes all HTTP calls made through the SDK, including internal registry queries and any consumer fetches, to be routed through attacker-controlled code in the transitive dependency @merceas/cross-fetch. The attack vector is the forced installation of this malicious transitive package, enabling potential interception or manipulation of network requests made by the SDK.

Users installing @merceas/anchor versions 0.32.1 and 0.32.3 unknowingly pull in a malicious transitive dependency that intercepts all HTTP requests made through the SDK. This can lead to data interception, manipulation, or other malicious activities controlled by the attacker. The malicious code is not in the main package tarball but in the aliased cross-fetch dependency, making detection harder.

No official patch or remediation is currently documented. Users should avoid installing or using the @merceas/anchor package, especially versions 0.32.1 and 0.32.3. Instead, use the legitimate @coral-xyz/anchor package from the official source. Monitor vendor advisories for updates or official fixes. Since this is a typosquatting attack, verifying package authenticity before installation is critical.