app-soda-layer version 2.1.6 is a malicious npm package that acts as a credential stealer and SSH backdoor. It executes automatically on installation via a postinstall hook, harvesting Solana keypairs, configuration files, and environment secrets. The malware installs an attacker-supplied SSH public key to enable persistent remote access by opening port 22. The package was short-lived, published and unpublished within hours, and is now unavailable from the npm registry. Hosts that installed this package should be considered compromised and require secret rotation and forensic checks.