A Node.js stage-one dropper attributed in the excerpt to Lazarus Group's TraderTraitor sub-cluster uses Solana transaction memos as a dead-drop resolver for rotating C2 infrastructure. The malware queries a specific Solana wallet through the public mainnet RPC API, extracts the latest memo, decodes a base64 URL, and fetches an AES-encrypted second-stage payload whose IV and key are supplied in HTTP response headers. The campaign is described as targeting macOS-first Solana developers through malicious npm postinstall scripts, with a 120-second anti-sandbox delay and a beacon limiter stored in ~/init.json. The source says 51 memo transactions and seven Vultr VPS nodes were observed over roughly four months, while a 20-byte kill-switch response caused the dropper to exit during live probing.