@coralxyz/anchor@0.30.2

Package @coralxyz/anchor impersonates the legitimate Solana Anchor framework package @coral-xyz/anchor (hyphen removed). The npm postinstall hook, implemented in scripts/postinstall.js, hides all string literals behind a hex-escaped string-array decoder (_0x5a2f / _0xf). On Windows (win32), the decoded logic downloads a zip archive from the anonymous file host https://files.catbox.moe/9bppy2.zip, extracts it via PowerShell Expand-Archive to a temporary directory, walks the extracted tree, and spawns any.exe file it finds detached with windowsHide. index.js is a minimal stub; the package's advertised Anchor framework functionality is not present, and the postinstall dropper is the sole meaningful behavior. The delivery vector is name confusion with the widely used @coral-xyz/anchor package.