MAL-2026-10900

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/solana-web3-fork/MAL-2026-10900.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-10900
Aliases
  • GHSA-rf7g-mf44-5m44
Published
2026-07-20T10:59:23Z
Modified
2026-09-01T11:31:27Z
Summary
Malicious code in solana-web3-fork (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (912cb41aa6b78cf62207dbf95f7d6247238483a800fa9bc6edd9b9d9f7819364)

Package name appears to fork or imitate the well-known @solana/web3.js library. Bundled files lib/index.cjs.js and lib/index.esm.js contain co-occurring patterns of child_process usage, fetch/POST/GET calls, and shell utilities (curl, ping) within the same minified bundles. These keyword co-occurrences in a minified Solana SDK fork are concerning but cannot be conclusively distinguished from legitimate SDK behavior (RPC calls, build tooling) without semantic verification of the bundle. Specific hardcoded attacker C2 endpoints, credential-theft paths, or install-time lifecycle hooks have not been confirmed. Given the name-collision with a major crypto SDK and the suspicious pattern stacking in the bundle, manual review is warranted before allowing installer use.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "RLMA-2026-05622",
            "import_time": "2026-07-20T13:14:51.861888568Z",
            "modified_time": "2026-07-20T10:59:23Z",
            "sha256": "1bc559bc0125cc1b97a9049b05819eed10a306fc96bdcf849377be3c164f5007",
            "source": "reversing-labs",
            "versions": [
                "1.0.0"
            ]
        },
        {
            "id": "IN-MAL-2026-013008",
            "import_time": "2026-08-05T06:00:30.479714602Z",
            "modified_time": "2026-08-05T05:20:41Z",
            "sha256": "912cb41aa6b78cf62207dbf95f7d6247238483a800fa9bc6edd9b9d9f7819364",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ]
        },
        {
            "id": "RLUA-2026-06503",
            "import_time": "2026-09-01T11:18:25.050389107Z",
            "modified_time": "2026-08-24T17:11:30Z",
            "sha256": "1e247514da2aeddeb3d93f2194b2041beee3594c2b19db6f52b0bac7ee9440f6",
            "source": "reversing-labs"
        }
    ]
}
References
Credits

Affected packages

npm / solana-web3-fork

Package

Name
solana-web3-fork
View open source insights on deps.dev
Purl
pkg:npm/solana-web3-fork

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "lib/index.cjs.js",
            "sha256": "f5d62c50dac9bc82c50b7b5a3b230009127f1f4b04d766db109fcb7a80b86262",
            "tlsh": "1c74a2097af260a2499330a61f2b6485a736d007350cd8757dce93742f5ebbc86b7fa4"
        },
        {
            "path": "lib/index.esm.js",
            "sha256": "84138890f476d20b59bb586f2f24856c61ba20d389984718c1b33a7b94e67c24",
            "tlsh": "ae74b4497af221a20d5330a66f2b6045a736a107390cdc647dce93641f5ebbc87b7fa4"
        }
    ],
    "package_integrity": [
        {
            "filename": "solana-web3-fork-1.0.0.tgz",
            "hashes": {
                "sha1": "48fc4302bf76674656df32add73db7863f75e141",
                "sha512_sri": "sha512-0rg7STLbtu/b2SDfDglrnWdEFVL57HrUSd/6a/f/rdXh2EeEQtUYpsZUGVtMlrkwD6592V89GXiIMQ54Xsj1Rg=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/solana-web3-fork/MAL-2026-10900.json"