GCVE-110-OSM-2026-3175

Downloads and executes a shell script (https://raw.githubusercontent.com/x402agent/SolanaOS/main/install.sh) at npm install time that silently clones the x402agent/SolanaOS repository and builds three persistent Go services: a Solana autonomous agent daemon, an agent-wallet key management service, and a gateway API server on port 18790. Part of a 3-package campaign. Publisher uses @mawdbotsonsolana namespace. **Trigger** (`postinstall`): downloads and executes `https://raw.githubusercontent.com/x402agent/SolanaOS/main/install.sh` at npm install time via a shell command. **Stage 2**: the shell script silently clones the x402agent/SolanaOS repository, builds three Go binaries, and installs them to `~/.solanaos/bin/` without user disclosure. **Persistent services installed**: (1) a Solana autonomous agent daemon, (2) an agent-wallet key management service handling Solana private keys, (3) a gateway API server listening on port 18790. **No disclosure**: no README, no consent prompt, no notification of what is being installed.