MAL-2026-10591

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/solana-key-utils/MAL-2026-10591.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-10591
Published
2026-07-14T13:58:15Z
Modified
2026-07-15T09:19:28Z
Summary
Malicious code in solana-key-utils (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (68b4680547530fce361014fe8c228734a8ec33bc8c834f46285e371e8f6b9f92)

On require(), index.js waits 37 seconds, reads test/fixtures/keypairs.dat (a 53KB base64 blob disguised as a test fixture, no test harness references it), base64-decodes it to ~39KB of opaque JavaScript, writes the result to ~/.cache-db/.node-sync/syncd.js with mode 0700, and spawns 'node syncd.js' detached with stdio ignored. The package then installs scheduled persistence on all three major platforms: a crontab entry running the dropped script every 12 hours on Linux, a scheduled task named 'WinNodeSync' on Windows via schtasks, and a LaunchAgent at ~/Library/LaunchAgents/com.apple.syncd.plist on macOS with RunAtLoad and StartInterval 43200. The dropped payload then re-executes every 12 hours independent of the original require, giving whoever published the package persistent code execution on the installer's machine. The 'solana-key-utils' name and 'test fixture' framing are cover for the smuggled executable payload.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-010509",
            "import_time": "2026-07-14T14:37:51.88679259Z",
            "modified_time": "2026-07-14T13:58:26Z",
            "sha256": "1e3abea52b0179f961bc14d9c33dd5c95569c215b21852470a3282cf2a1ddc6c",
            "source": "amazon-inspector",
            "versions": [
                "1.0.2"
            ]
        },
        {
            "id": "IN-MAL-2026-010508",
            "import_time": "2026-07-14T14:37:51.784631326Z",
            "modified_time": "2026-07-14T13:58:15Z",
            "sha256": "68b4680547530fce361014fe8c228734a8ec33bc8c834f46285e371e8f6b9f92",
            "source": "amazon-inspector",
            "versions": [
                "1.0.1"
            ]
        },
        {
            "id": "IN-MAL-2026-010525",
            "import_time": "2026-07-14T16:58:36.951429373Z",
            "modified_time": "2026-07-14T16:45:09Z",
            "sha256": "e335b56f5c3bb36be08872fefb6fbdc8d065a5365ae5ab1c55b609bb715e9a13",
            "source": "amazon-inspector",
            "versions": [
                "1.0.3"
            ]
        },
        {
            "id": "IN-MAL-2026-010660",
            "import_time": "2026-07-15T08:51:06.735034887Z",
            "modified_time": "2026-07-15T08:15:17Z",
            "sha256": "f2c457089861607b22a6e24803c7377e34df30962338fa4a9aa0a8f01ac9835b",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / solana-key-utils

Package

Name
solana-key-utils
View open source insights on deps.dev
Purl
pkg:npm/solana-key-utils

Affected ranges

Affected versions

1.*
1.0.0
1.0.1
1.0.2
1.0.3

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "index.js",
            "sha256": "a3d377d0dd317a0575c4d733b8303804d0923c735c3e647c7387bc89aa28fc0e",
            "tlsh": "8051197137126137530130d338b6ed86d9f94730f41895c8c9cec4c71a82ed84ab9772"
        },
        {
            "path": "test/fixtures/keypairs.dat",
            "sha256": "75f8bbd9c51bad2d4c1d160391317595a8d033003e87067a3b2e0dd9811373cd",
            "tlsh": "193301b145ae62df237c6aa658cf7880ac6e2ad56ca825c11bc0917a54fc710ff3f034"
        }
    ],
    "package_integrity": [
        {
            "filename": "solana-key-utils-1.0.2.tgz",
            "hashes": {
                "sha1": "c5dafe1b67332fcede7302538da21e4b38e828c3",
                "sha512_sri": "sha512-qRfG8zqCHNjtHfRhJucDSIvBK73Ig/JotrOciqJbM9QDdFdpMoFXvJygfjxk82Jm3kc8wvXvjr01XC/ANDS7pQ=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/solana-key-utils/MAL-2026-10591.json"