MAL-2026-10904

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/solana-web3-v1/MAL-2026-10904.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-10904
Aliases
  • GHSA-x736-hhp7-jrh7
Published
2026-07-20T10:59:25Z
Modified
2026-09-01T11:31:02Z
Summary
Malicious code in solana-web3-v1 (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (073f4c1e75630bbf1c535a334f4d7f233a73439240bc22e69bac0e926c8c58a0)

Package name closely mirrors the widely-used @solana/web3.js Solana SDK while being published under an unrelated, unscoped name. The bundled lib/index.cjs.js and lib/index.esm.js contain co-occurring patterns of require('child_process'), fetch/POST/GET calls, and shell utilities (curl, ping) within the same minified bundle. Without traced execution, it cannot be confirmed from these matches alone whether the network calls are user-facing RPC client functionality (consistent with a Solana SDK) or a hardcoded exfiltration channel, nor whether the child_process/curl/ping usage is dead/library code or reachable on import. Given the strong name-confusion against a high-traffic SDK target, the combination of HTTP + child_process + shell-tool keywords inside a single bundle, and the lack of clean traced evidence, this should not be auto-allowed; a human should verify the destinations, the reachability of the child_process paths, and whether the package is a legitimate fork/mirror or a confusion-attack lure.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "RLMA-2026-05626",
            "import_time": "2026-07-20T13:14:52.208607023Z",
            "modified_time": "2026-07-20T10:59:25Z",
            "sha256": "6e70afc2cb0aa128d81d9347accbde8cefd415af05727bfd27745495f00d96ad",
            "source": "reversing-labs",
            "versions": [
                "1.0.0"
            ]
        },
        {
            "id": "IN-MAL-2026-013006",
            "import_time": "2026-08-05T06:00:30.233848483Z",
            "modified_time": "2026-08-05T05:20:24Z",
            "sha256": "073f4c1e75630bbf1c535a334f4d7f233a73439240bc22e69bac0e926c8c58a0",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ]
        },
        {
            "id": "RLUA-2026-06507",
            "import_time": "2026-09-01T11:18:25.291641822Z",
            "modified_time": "2026-08-24T17:11:42Z",
            "sha256": "3ce97443aefb64bf8fd37d39138faac89f354220df72d690e0a6ccb91adb1044",
            "source": "reversing-labs"
        }
    ]
}
References
Credits

Affected packages

npm / solana-web3-v1

Package

Name
solana-web3-v1
View open source insights on deps.dev
Purl
pkg:npm/solana-web3-v1

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "lib/index.cjs.js",
            "sha256": "f5d62c50dac9bc82c50b7b5a3b230009127f1f4b04d766db109fcb7a80b86262",
            "tlsh": "1c74a2097af260a2499330a61f2b6485a736d007350cd8757dce93742f5ebbc86b7fa4"
        },
        {
            "path": "lib/index.esm.js",
            "sha256": "84138890f476d20b59bb586f2f24856c61ba20d389984718c1b33a7b94e67c24",
            "tlsh": "ae74b4497af221a20d5330a66f2b6045a736a107390cdc647dce93641f5ebbc87b7fa4"
        }
    ],
    "package_integrity": [
        {
            "filename": "solana-web3-v1-1.0.0.tgz",
            "hashes": {
                "sha1": "37ba55c1f66a3c8e87e4715d1de229cc8045d9d7",
                "sha512_sri": "sha512-UqGdfoU5+7DNl3v2k5Xgr9Ct6AM0iLes0A/VIGQgCAJbIHZITP0iyBZKgyd/mBW8aeN1Zp3QdypgUplDeTejzA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/solana-web3-v1/MAL-2026-10904.json"