The @merceas/anchor npm package is a typosquatting impersonation of the legitimate @coral-xyz/anchor Solana Anchor SDK. It replaces the standard cross-fetch dependency with a malicious aliased package under the same scope, causing all HTTP requests made through the SDK to be routed through attacker-controlled code. This malicious behavior is embedded in the transitive dependency @merceas/cross-fetch, not directly in the main package tarball. Versions 0.32.1 and 0.32.3 of @merceas/anchor are affected.