The malicious npm package @coralxyz/anchor (version 0.30.2) impersonates the legitimate Solana Anchor framework package @coral-xyz/anchor by a subtle name difference (missing hyphen). Its postinstall hook uses obfuscated code to download a zip archive from https://files.catbox.moe/9bppy2.zip, extracts it using PowerShell, and executes any .exe files found in the extracted content on Windows systems. The package does not provide any legitimate Anchor framework functionality and serves solely as a dropper for potentially harmful executables. This attack vector exploits user confusion due to the similar package name.

Users who install @coralxyz/anchor version 0.30.2 on Windows systems may inadvertently execute malicious code delivered via the postinstall script. This can lead to arbitrary code execution on the affected system. The package does not deliver any legitimate functionality, indicating its sole purpose is malicious payload delivery. No known exploits in the wild have been reported yet.

No official patch or fix is currently available. Users should avoid installing the @coralxyz/anchor package and instead ensure they use the legitimate @coral-xyz/anchor package with the hyphen. Verify package names carefully before installation to prevent supply chain attacks based on name confusion. Monitor for updates from the legitimate package maintainers or npm advisories for any remediation.