MAL-2026-12100

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@wethenorth12/solana-spl-token/MAL-2026-12100.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12100
Published
2026-08-05T06:24:04Z
Modified
2026-08-05T07:20:56.795663527Z
Summary
Malicious code in @wethenorth12/solana-spl-token (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (7dde46db2fbc17fae2957070f85bc43fdb1d265444f2e5adc936faa6f82e96e2)

@wethenorth12/solana-spl-token is a typosquat of the legitimate @solana/spl-token package. On module load, index.js collects hostname, username, home directory, platform, current working directory, and the entire process.env, base64-encodes the JSON payload, and sends it via HTTPS GET to a hardcoded Telegram Bot API endpoint (bot id 7231970337, chatid 8969499041). A flag file in the OS tmpdir prevents re-sending on subsequent requires. The package additionally ships stub wallet primitives (createWallet, generateMnemonic, signTransaction) that return random or no-op values when the real @solana/spl-token is not present, while marketing itself in the README as a drop-in replacement. Environment variables in CI and developer machines routinely contain credentials such as AWS*, GITHUBTOKEN, NPMTOKEN, and database connection strings, all of which leave the installer's host to an author-controlled Telegram destination on any require of this package.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-013444",
            "import_time": "2026-08-05T07:06:47.780643385Z",
            "sha256": "7dde46db2fbc17fae2957070f85bc43fdb1d265444f2e5adc936faa6f82e96e2",
            "modified_time": "2026-08-05T06:24:04Z",
            "source": "amazon-inspector",
            "versions": [
                "0.4.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @wethenorth12/solana-spl-token

Package

Name
@wethenorth12/solana-spl-token
View open source insights on deps.dev
Purl
pkg:npm/%40wethenorth12/solana-spl-token

Affected ranges

Affected versions

0.*
0.4.0

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "index.js",
            "tlsh": "842179cc27f2bd8d16377592982f600bb27bc5b60488f614c564e1c37f705c85a16b94",
            "sha256": "963f4cb0eb93714a1f3571f6c031f997cb569a155f08d8dfcbaf349bf64746b2"
        }
    ],
    "package_integrity": [
        {
            "filename": "solana-spl-token-0.4.0.tgz",
            "hashes": {
                "sha1": "3874c9ddd0cc9e7853784a69bf5c2056a128e04c",
                "sha512_sri": "sha512-/yKFe4vbCmRVhOMEREFP1ZNgz9HODqZZXPM5CayWAwG0f0st5oMdscUFUc5EWtJAx/X5O/W0VHraIT1zcydVcg=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@wethenorth12/solana-spl-token/MAL-2026-12100.json"