The npm package @coralxyz/anchor is a malicious package impersonating the legitimate Solana Anchor framework package @coral-xyz/anchor by removing the hyphen in the name. Its postinstall script on Windows systems downloads and extracts a zip archive from an anonymous file host, then executes any .exe files found, without providing any legitimate functionality. This package is a supply chain threat relying on name confusion to trick users into installing it.