-= Per source details. Do not edit below this line.=-
The package's bundled entry points (lib/index.cjs.js and lib/index.esm.js) co-locate require('child_process'), fetch/POST/GET calls, and references to curl/ping within minified output. The package name suggests a Solana RPC client, which would legitimately make HTTP/RPC calls; keyword co-occurrence in a minified bundle is consistent with both that legitimate shape and an exfiltration shape, and the available evidence does not show the destination URLs, whether any code path runs at install/import time, or whether process.env or credential paths feed any of the network calls. No package.json lifecycle hook content has been confirmed. Routing to human review so a reviewer can de-minify the relevant spans (around lines 5016/5046, 11212/11317) and confirm whether the network destinations are documented Solana RPC endpoints (allow) or attacker-controlled hosts (escalate to block).
1.0.0Exploitability
AV:NAC:LPR:NUI:NScope
S:CImpact
C:HI:HA:H10.0/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H