@solana-labs/ancornpm

Package name @solana-labs/ancor is a one-character typosquat of the legitimate @coral-xyz/anchor / @project-serum/anchor Solana framework, published under the @solana-labs scope to impersonate official Solana Labs tooling. package.json declares "postinstall": "node install.js", which fires automatically on npm install. install.js reads host identifiers via os.hostname() and process.platform, invokes child_process.execSync, issues outbound HTTP/HTTPS traffic (including a POST at line 113 and a curl shell-out at line 173), and references https://api.mainnet-beta.solana.com as cover traffic. The combination of (a) impersonating-scope name targeting a top-tier ecosystem package, (b) a postinstall lifecycle hook executing a script that reads host identity and shells out to network primitives, and (c) execSync of arbitrary commands during install constitutes an install-time host reconnaissance / command-execution payload against any developer or build system that installs this package.