MAL-2026-12123

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@zzzgenesis00/solana-spl-token/MAL-2026-12123.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12123
Published
2026-08-05T08:43:26Z
Modified
2026-08-05T10:05:40.071048043Z
Summary
Malicious code in @zzzgenesis00/solana-spl-token (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (985d4d8e5069084334daa08512249314d36d9fa8662adef050021c2400dacbdd)

@zzzgenesis00/solana-spl-token@0.4.0 impersonates the Solana SPL Token package and runs postinstall.js on npm install. The script harvests host identity, reads ~/.ssh, ~/.npmrc, and ~/.gitconfig, probes Chrome/Firefox profiles and cryptocurrency wallet directories, and scrapes ~40 credential-shaped environment variables including NPMTOKEN, NODEAUTHTOKEN, GITHUBTOKEN, AWS_*, MNEMONIC, SEEDPHRASE, SOLANAPRIVATEKEY, and Helius/Infura/Alchemy API keys. It shells out via childprocess.execSync to run npm whoami and git config --global user.email, capturing the installer's npm login identity alongside the stolen ~/.npmrc auth token. The collected JSON is exfiltrated over two channels: the Telegram Bot API (hardcoded bot token, chat_id) at api.telegram.org, and an HTTP POST to 40f955f39128bd79-178-249-214-24.serveousercontent.com/collect (a serveo tunnel). Execution is delayed with setTimeout and random jitter to obscure the beacon.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-014390",
            "import_time": "2026-08-05T09:28:05.437416148Z",
            "sha256": "985d4d8e5069084334daa08512249314d36d9fa8662adef050021c2400dacbdd",
            "modified_time": "2026-08-05T08:43:26Z",
            "versions": [
                "0.4.0"
            ],
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / @zzzgenesis00/solana-spl-token

Package

Name
@zzzgenesis00/solana-spl-token
View open source insights on deps.dev
Purl
pkg:npm/%40zzzgenesis00/solana-spl-token

Affected ranges

Affected versions

0.*
0.4.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-lkp+3FSpLvHhqnOjCGulP+i3VfQBISs5F73wJisYPKpq3nWULBJWHIPsT5E4qQK9aeZfpR8bmJD6le+1Doce5Q==",
                "sha1": "4c1c68396ec4e7022fe71c8b9591bb2c53540483"
            },
            "filename": "solana-spl-token-0.4.0.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "postinstall.js",
            "sha256": "a302faed20974152bb9637ea56ef49f5ee7e907436d8f11ed8e368938b85a05e",
            "tlsh": "20d161da12e603186892b9ad8b4f40141a37d5033c20faf47ecd8b154f4e93c9bb67a8"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@zzzgenesis00/solana-spl-token/MAL-2026-12123.json"