MAL-2026-5442

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/exodus-solana-sdk/MAL-2026-5442.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-5442
Published
2026-06-09T17:44:20Z
Modified
2026-06-09T18:01:36Z
Summary
Malicious code in exodus-solana-sdk (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (ecffe98bff5e1c4655631cf8f92b1b1ccb534e0eeaa7043fab0d5fa1fbfabc35)

Package name impersonates the Exodus cryptocurrency wallet brand (exodus-solana-sdk). package.json declares a postinstall hook (node src/canary.js) that fires automatically on npm install. canary.js performs a DNS lookup and HTTPS GET to a hardcoded 96e03fa6c292469a-172-245-86-254.serveousercontent.com endpoint — a serveo.net reverse-tunnel domain that is anonymous, mutable, and operator-controlled. The hostname embeds an IPv4 address (172.245.86.254), and the response body is silently discarded (r.resume()), confirming the request's purpose is reconnaissance rather than data delivery to the installer. The beacon reveals the installer's egress IP, DNS resolver, and install-time event to whoever controls the tunnel. The package's own description self-identifies as a 'Security research canary — Exodus HackerOne PoC. Not a real package.', but it is published to the public npm registry where any developer who mistypes the package name will execute the beacon. Self-declared research framing does not neutralize installer-side harm: install-time outbound network to an anonymous tunnel under a brand-impersonating package name is the typosquat-reconnaissance attack shape.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-005110",
            "import_time": "2026-06-09T17:45:55.115477785Z",
            "modified_time": "2026-06-09T17:44:21Z",
            "sha256": "8f222f4981a374a98219a8b4fd00b46127e599c448f2f0881e558f4984c57d08",
            "source": "amazon-inspector",
            "versions": [
                "99.0.0-canary.1"
            ]
        },
        {
            "id": "IN-MAL-2026-005109",
            "import_time": "2026-06-09T17:45:55.072246699Z",
            "modified_time": "2026-06-09T17:44:20Z",
            "sha256": "ecffe98bff5e1c4655631cf8f92b1b1ccb534e0eeaa7043fab0d5fa1fbfabc35",
            "source": "amazon-inspector",
            "versions": [
                "99.0.0-canary.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / exodus-solana-sdk

Package

Name
exodus-solana-sdk
View open source insights on deps.dev
Purl
pkg:npm/exodus-solana-sdk

Affected ranges

Affected versions

99.*
99.0.0-canary.1

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "domains": [
        "96e03fa6c292469a-172-245-86-254.serveousercontent.com"
    ],
    "evidence_files": [
        {
            "path": "src/canary.js",
            "sha256": "ef2b6f485b2532da51b9f5f82a44416947f1d965023718a03005da3a51a68b45",
            "tlsh": "4ed022fe91c4080aa3a047ac841a60cab94bc9f8008485d2730c86d220c0aeea2ac238"
        },
        {
            "path": "package.json",
            "sha256": "2a0a8913bdbc8661152e0ea8af968912046175711f0d6bd8ec9fe8a44e9f1ecd",
            "tlsh": "ded09704886002333dc889e70ea2c08a40283c072220bc2c93633404300cf771ff3220"
        }
    ],
    "package_integrity": [
        {
            "filename": "exodus-solana-sdk-99.0.0-canary.1.tgz",
            "hashes": {
                "sha1": "0a3c41a02014c79574d497720f5949ac9dfed323",
                "sha512_sri": "sha512-NMEn10jlHkRiXgqS9u1rkNLJaMQuyCTmtrCOuEM3JY4tbX21Gs1Mon7O8B5GZRo3H6Esix6YW6L5bSlZxAEO3g=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/exodus-solana-sdk/MAL-2026-5442.json"