Velora (formerly ParaSwap) SDK Version 9.4.1 Compromised And Installing Malware

This report documents a supply-chain compromise in the npm package @velora-dex/sdk v9.4.1 where a base64-encoded payload in package/dist/index.js decodes and runs a curl-downloaded shell script from http://89.36.224.5/troubleshoot/mac/install.sh, enabling silent background execution, persistence via nohup, and arbitrary code execution; version 9.4.2 removed the malicious code and the report includes IoCs, detection commands, remediation guidance, and secure development recommendations.