The npm package @baanx/solana-lib contains malicious code that executes automatically upon installation. It collects the installer's username, hostname, and current working directory, then sends this information via a DNS lookup to a suspicious external domain. This behavior is obfuscated and inconsistent with legitimate Solana library functionality. Installation of this package can lead to full system compromise, requiring immediate secret and key rotation and package removal.