MAL-2026-10901

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/solana-web3-lts/MAL-2026-10901.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-10901
Aliases
  • GHSA-8wj2-r9xj-g9p3
Published
2026-07-20T10:59:24Z
Modified
2026-09-01T11:31:01Z
Summary
Malicious code in solana-web3-lts (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (51efd3d5cdcb8fb794a1702f586abd7018d86aad3e40286f5a43dd1127d804ed)

Package name 'solana-web3-lts' resembles the widely-used '@solana/web3.js' Solana SDK, raising name-confusion concerns for installers reaching for the official client. The shipped library bundles (lib/index.cjs.js, lib/index.esm.js) contain co-occurring use of child_process, fetch/POST/GET, and shell utilities (curl, ping) within large minified files; pattern-level signals match exfiltration shapes but full semantic tracing of the bundle did not complete, so it is not confirmed whether these primitives are reachable from an install/import path or are part of legitimate SDK functionality (e.g., RPC HTTP transports, build tooling). Recommend human review of the bundle to determine whether the child_process + network combination represents a hardcoded C2 exfiltration path or benign SDK code, and to confirm the package's relationship (if any) to the official Solana web3 client.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "RLMA-2026-05623",
            "import_time": "2026-07-20T13:14:51.946026412Z",
            "modified_time": "2026-07-20T10:59:24Z",
            "sha256": "17de020deed3039d0004c8c7d53de909c604e25b233c3e2ff6ab6586fa781967",
            "source": "reversing-labs",
            "versions": [
                "1.0.0"
            ]
        },
        {
            "id": "IN-MAL-2026-012967",
            "import_time": "2026-08-05T06:00:25.61805043Z",
            "modified_time": "2026-08-05T05:14:49Z",
            "sha256": "51efd3d5cdcb8fb794a1702f586abd7018d86aad3e40286f5a43dd1127d804ed",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ]
        },
        {
            "id": "RLUA-2026-06504",
            "import_time": "2026-09-01T11:18:25.110990996Z",
            "modified_time": "2026-08-24T17:11:41Z",
            "sha256": "73c314527cacf33dbf9e3853afe7c7f75e51e8137b2b09c4f5a89f27132bd68e",
            "source": "reversing-labs"
        }
    ]
}
References
Credits

Affected packages

npm / solana-web3-lts

Package

Name
solana-web3-lts
View open source insights on deps.dev
Purl
pkg:npm/solana-web3-lts

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "lib/index.cjs.js",
            "sha256": "f5d62c50dac9bc82c50b7b5a3b230009127f1f4b04d766db109fcb7a80b86262",
            "tlsh": "1c74a2097af260a2499330a61f2b6485a736d007350cd8757dce93742f5ebbc86b7fa4"
        },
        {
            "path": "lib/index.esm.js",
            "sha256": "84138890f476d20b59bb586f2f24856c61ba20d389984718c1b33a7b94e67c24",
            "tlsh": "ae74b4497af221a20d5330a66f2b6045a736a107390cdc647dce93641f5ebbc87b7fa4"
        }
    ],
    "package_integrity": [
        {
            "filename": "solana-web3-lts-1.0.0.tgz",
            "hashes": {
                "sha1": "b7624c4e9b0473a08ed55e95bd86f2ae0c778179",
                "sha512_sri": "sha512-Vp7uB/pQuhl5ZVFEWaG+Ix2Er1FDnPNtc2m9/uS3Nfv7L4bcB5Be2eE1tPN1shyTx/TEPK7XPfTZRVqpX2OUZg=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/solana-web3-lts/MAL-2026-10901.json"