MAL-2026-16300

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@baanx/solana-lib/MAL-2026-16300.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-16300
Published
2026-09-21T03:09:52Z
Modified
2026-09-21T03:30:16Z
Summary
Malicious code in @baanx/solana-lib (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (6462ecac2764fc9cf78d47ee57fec1fd3d6a0cf573ee02eaddcc2e5b5f3f0d7e)

The package declares scripts.install = node index.js, so npm install @baanx/solana-lib automatically executes index.js, which loads lib/core.js. That module reads the installer's username (os.userInfo().username), hostname (os.hostname()), and current working directory basename, concatenates them with a timestamp and the static prefix bxsol, and issues a dns.resolve4() lookup against <prefix>.<user>.<host>.<cwd>.<ts>.oob.algamil7x.xyz — a DNS-based out-of-band beacon that leaks installer identity to a hardcoded non-first-party domain. Helper modules lib/e5f0a2.js and lib/f6a1b3.js reconstruct the strings os, dns, userInfo, hostname, cwd, resolve4, the prefix bxsol, and the destination host oob.algamil7x.xyz from String.fromCharCode byte arrays, and load Node builtins indirectly via module.constructor._load('os') / _load('dns') to conceal the behavior. The package is presented as a Solana library; the char-code-obfuscated destination and the install-time host-recon beacon are inconsistent with any legitimate Solana functionality.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-020204",
            "import_time": "2026-09-21T03:24:21.12515012Z",
            "modified_time": "2026-09-21T03:09:52Z",
            "sha256": "6462ecac2764fc9cf78d47ee57fec1fd3d6a0cf573ee02eaddcc2e5b5f3f0d7e",
            "source": "amazon-inspector",
            "versions": [
                "9.9.10"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @baanx/solana-lib

Package

Name
@baanx/solana-lib
View open source insights on deps.dev
Purl
pkg:npm/%40baanx/solana-lib

Affected ranges

Affected versions

9.*
9.9.10

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "lib/core.js",
            "sha256": "6b930c020246e5d616d754ba88c612a92ace1b5b51dc26cedd0bb0032d6faef4",
            "tlsh": "36f0a229b3a3c08fa7e092d0361a43d18459c3c0d7cf4191fb7c0e87904e7d1cac596a"
        },
        {
            "path": "lib/f6a1b3.js",
            "sha256": "722c82e72c54a47cc5390ee243e7a19f3843ce3d5759751f9a05b31a2c2d7f49",
            "tlsh": "efe0201b25afe14fa6e85ee72f17d4dac8920e00e21d4bd9f91d0687206a007c0c0770"
        }
    ],
    "package_integrity": [
        {
            "filename": "solana-lib-9.9.10.tgz",
            "hashes": {
                "sha1": "b87b5380d6227dfaf0bd7ef43fb1840f1b4bddaf",
                "sha512_sri": "sha512-l/huo77kYbinGs6lKg46g54IdORPVKMZywhfgvirXWCtDXy1N3GQpt7lP+kZEHUq8FLEN1tqdFY+AxgEWbP12Q=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@baanx/solana-lib/MAL-2026-16300.json"