The 'solana-core-4' npm package at version 1.0.0 is identified as malicious due to embedded code that automatically executes upon installation. This code harvests sensitive credentials including SSH private keys (~/.ssh/id_rsa), cryptocurrency wallet keys and seeds, and environment variables. The stolen data is exfiltrated to a fixed Telegram bot chat, indicating targeted data theft. The package is part of a campaign involving similarly named malicious packages and uses a naming pattern with generic crypto-related names plus numeric suffixes. The OpenSSF Package Analysis and Amazon Inspector flagged this package for malicious behavior and communication with known malicious domains.

Users who install 'solana-core-4' version 1.0.0 risk having their SSH private keys, cryptocurrency wallet keys, seeds, and environment variables stolen. This can lead to unauthorized access to systems and cryptocurrency wallets, resulting in potential financial loss and system compromise. The exfiltration to a Telegram bot suggests data is accessible to attackers in real time.

No official patch or remediation is currently available for this malicious package. Users should avoid installing 'solana-core-4' version 1.0.0 and remove it if already installed. Verify dependencies to ensure no indirect inclusion of this package. Monitor for suspicious postinstall scripts in npm packages. Since this is a malicious package rather than a vulnerability in legitimate software, remediation involves removal and avoidance rather than patching.