@solana-js/web3@1.91.3

Package name @solana-js/web3 impersonates the legitimate @solana/web3.js SDK, and package.json falsely attributes authorship to 'Solana Labs' with a solana.com homepage. The exported API is a non-functional stub (Connection.getBalance returns 0, sendTransaction returns random bytes) — no real Solana client functionality is present. On install, scripts/postinstall.js detects Windows and spawns a hidden PowerShell (`-NoP -W Hidden -Exec Bypass`) with a base64-encoded command. The decoded PowerShell performs an AMSI bypass via reflection over System.Management.Automation.AmsiUtils, downloads a binary payload from https://files.catbox.moe/a3loxy.bin, and executes it in-process using VirtualAlloc/CreateThread. The postinstall script further hex-escapes API names ('child_process', 'powershell', 'platform', 'win32') and fragments the PowerShell payload to hinder review. The result is arbitrary remote code execution on any Windows host that runs `npm install` against this package, with the shellcode fetched from an anonymous, mutable file host (files.catbox.moe) — a known-bad-infrastructure dropper pattern.