MAL-2026-11532

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@zzzgenesis00/solana-wallet-adapter/MAL-2026-11532.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-11532
Published
2026-08-04T22:08:32Z
Modified
2026-08-04T23:04:47.671510380Z
Summary
Malicious code in @zzzgenesis00/solana-wallet-adapter (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (313cd424f27cb12cf28c0ad6737c2b2d5b08ff37d8971ae65a3a0184a73d2c46)

The postinstall.js script, which runs automatically on npm install, harvests a broad set of installer-owned secrets and identity data and exfiltrates them to two hardcoded attacker-controlled destinations. Collected data includes sensitive environment variables (NPMTOKEN, NODEAUTHTOKEN, GITHUBTOKEN, AWS_*, HELIUS/INFURA/ALCHEMY keys, MNEMONIC, SEEDPHRASE, SOLANAPRIVATEKEY, and similar), the contents of ~/.ssh, ~/.npmrc, and ~/.gitconfig, Chrome/Firefox profile artifacts (Cookies, Login Data, key4.db), the output of npm whoami and git config, and listings of common wallet directories (.bitcoin,.ethereum,.solana,.metamask,.exodus,.electrum). About 1.5-3.5 seconds after postinstall start, the harvested JSON is sent via HTTPS GET to api.telegram.org using a hardcoded bot token and chatid (bot/chat 7231970337) and via HTTPS POST to 40f955f39128bd79-178-249-214-24.serveousercontent.com/collect (a Serveo tunnel). The package impersonates the anza-xyz Solana publisher via a false author field and a non-existent repository link, wraps the harvester in mangled identifiers (_stq/_dgx/_uiz/_cp/_ht/_tk/_ch/_co/_ex) with a cover-story comment 'postinstall environment verification', and re-exports ./index.js to appear functional. The stated wallet-adapter purpose does not justify any of the observed reads.

Database specific 
{
    "malicious-packages-origins": [
        {
            "source": "amazon-inspector",
            "modified_time": "2026-08-04T22:08:32Z",
            "sha256": "313cd424f27cb12cf28c0ad6737c2b2d5b08ff37d8971ae65a3a0184a73d2c46",
            "id": "IN-MAL-2026-011348",
            "versions": [
                "0.18.0"
            ],
            "import_time": "2026-08-04T22:30:12.025231413Z"
        }
    ]
}
References
Credits

Affected packages

npm / @zzzgenesis00/solana-wallet-adapter

Package

Name
@zzzgenesis00/solana-wallet-adapter
View open source insights on deps.dev
Purl
pkg:npm/%40zzzgenesis00/solana-wallet-adapter

Affected ranges

Affected versions

0.*
0.18.0

Database specific

cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-JVlJRjIxcxL50ZqxMiBMeh/pgnDysH6inl8ucxf0+TVPBwgRxLUa6ug9L/MdQZy4iTJ5XsnZ1b89UOiuhY4H/w==",
                "sha1": "8d0a6a3c9b2554bfc83b8fe86fa853a05c3d63ce"
            },
            "filename": "solana-wallet-adapter-0.18.0.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "postinstall.js",
            "sha256": "8286413c6cc63a2df835068445cd31e1ecc7c55114bc1c1ac759bdbc7ed5c53f",
            "tlsh": "cfd1859a22e603196852a96dc75f40341672e1033820fbf47ece0b516f4e92cdbb57bd"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@zzzgenesis00/solana-wallet-adapter/MAL-2026-11532.json"