Malicious Solana Packages Attacking Devs Abusing Slack And ImgBB For Data Theft

Malicious npm packages targeting Solana developers deploy a Windows trojan and PowerShell-based keylogger and screenshot stealer that exfiltrate captured keystrokes and images via Slack webhooks, ImgBB uploads, and Discord; the packages (solanacore, solana-login, walletcore-gen) share identical code, were downloaded ~1,900 times, and explicitly reference LOCKBITAI while lacking obfuscation, indicating active distribution and potential credential compromise.