The @baanx/solana-lib npm package declares an install script that runs 'node index.js' during installation. This script loads modules that gather the installer's system information—username, hostname, and current working directory basename—concatenates these with a timestamp and a static prefix, and performs a DNS resolve4 lookup to a hardcoded external domain 'oob.algamil7x.xyz'. The code uses obfuscation techniques such as reconstructing strings from character codes and indirect loading of Node.js built-in modules to conceal its behavior. This out-of-band DNS beacon leaks sensitive installer identity information to a non-first-party domain. The package is presented as a Solana library, but this malicious behavior is unrelated to legitimate Solana functionality. According to a malware source, any system with this package installed should be considered fully compromised.

Installation of this package results in leakage of sensitive system information to an attacker-controlled domain and likely full system compromise. All secrets and keys stored on the affected system may be exposed and must be rotated immediately. The malicious code runs automatically during installation, increasing the risk of unnoticed compromise. Removal of the package alone may not eliminate all malicious software or backdoors installed as a result.

Remove the @baanx/solana-lib package immediately if installed. Rotate all secrets and keys from a separate, trusted system. Because full system compromise is likely, conduct a thorough investigation and consider rebuilding the affected system. No official patch or fix is available; avoid using this package entirely.