MAL-2026-13351

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/spl-token-utils/MAL-2026-13351.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13351
Published
2026-08-05T15:39:00Z
Modified
2026-08-05T16:51:08.780827316Z
Summary
Malicious code in spl-token-utils (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (f95b625c92e85b1c0d5c10a192c70f8f82cf8d3b2ac7b66c034635b680785654)

On require, index.js serializes the full process.env together with hostname, username, homedir, platform, cwd, and package metadata, base64-encodes the payload, and sends it via an HTTPS GET to api.telegram.org/bot<redacted>/sendMessage with a hardcoded chat_id (8969499041). A marker file in the OS tmpdir suppresses repeat sends. The package presents itself as a drop-in replacement for @solana/spl-token and attempts to require and re-export the real @solana/spl-token so consumers see functional behavior while the exfiltration has already fired. Bulk process.env harvest at import time captures whatever credentials the installer's Node process has in environment — cloud keys, CI/publish tokens, database URLs — none of which relate to any legitimate SPL/Solana utility function. The typosquat name (spl-token-utils vs @solana/spl-token) makes accidental installs likely.

Database specific 
{
    "malicious-packages-origins": [
        {
            "versions": [
                "1.4.2"
            ],
            "id": "IN-MAL-2026-015780",
            "import_time": "2026-08-05T16:13:44.461778488Z",
            "modified_time": "2026-08-05T15:39:00Z",
            "source": "amazon-inspector",
            "sha256": "f95b625c92e85b1c0d5c10a192c70f8f82cf8d3b2ac7b66c034635b680785654"
        }
    ]
}
References
Credits

Affected packages

npm / spl-token-utils

Package

Name
spl-token-utils
View open source insights on deps.dev
Purl
pkg:npm/spl-token-utils

Affected ranges

Affected versions

1.*
1.4.2

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
indicators 
{
    "package_integrity": [
        {
            "filename": "spl-token-utils-1.4.2.tgz",
            "hashes": {
                "sha512_sri": "sha512-C6kn6gm9Zu15m5rPCeczJgi/MYZmPNtntI7E4M7GGncdbVpgRVnwHpNz1UvHY7oE+EyDSj0rf+N11tj/GQunoA==",
                "sha1": "dbd09f3b9ee447dc59ab65a5de488c532d4b5b9b"
            }
        }
    ],
    "evidence_files": [
        {
            "path": "index.js",
            "tlsh": "4221229c27f1ba4e12326492652f610a72bbc9f10488f654d598d1c73f702c8da66798",
            "sha256": "7e9343c88b6d2f9c864022f72b3630afc7d8fb8f32f507cbfd92b171aee7471c"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/spl-token-utils/MAL-2026-13351.json"