@solana-labs/web3jsnpm

This package impersonates the legitimate @solana/web3.js library under a confusable scope (@solana-labs/web3js). On npm install, the postinstall hook executes install.js, which loads os, child_process, fs, and https, collects host identifiers via os.hostname() and os.userInfo() along with process.platform, probes filesystem paths via fs.existsSync(...), and issues HTTPS POST requests carrying the harvested information. install.js also invokes execSync('powershell...') and execSync('curl...') to run shell commands fetched/triggered at install time. A reference to http://www.apple.com appears alongside the exfiltration code, consistent with connectivity-check or decoy behavior. The combination of name-squat against a widely used Solana library, automatic execution at install via postinstall, host enumeration, and shell execution constitutes an installer-targeted supply-chain attack.