Cybersecurity analysts have identified a harmful package on the Python Package Index (PyPI) repository that claims to be an application associated with the Solana blockchain, but harbors malicious features designed to expropriate source code and developer credentials.
The package, dubbed solana-token, has been removed from PyPI, but not before it was downloaded 761 times. It was initially