MAL-2026-5560

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/solana-web3-community/MAL-2026-5560.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-5560
Published
2026-06-11T02:58:17Z
Modified
2026-06-11T04:01:29.226507082Z
Summary
Malicious code in solana-web3-community (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (202fa4daf22c4ecace931dfbdbeee6821fe42c14956d35c763c55051528dee12)

Package masquerades as the official @solana/web3.js SDK (name solana-web3-community, author 'Solana Labs Maintainers maintainers@solanalabs.com', repository solana-foundation/solana-web3.js, homepage solana.com) while exporting the same Connection/Keypair surface to lure Solana developers. On import, lib/index.cjs.js (and the ESM twin lib/index.esm.js) executes a credential-stealing payload that reads ~/.config/solana/id.json, ~/.ssh/idrsa, ~/.aws/credentials, and project.env files, and iterates process.env collecting any variable whose name matches KEY/SECRET/MNEMONIC/PRIVATE/TOKEN/PASSWORD/AWS/NPM/GITHUB/CI/DEPLOY/SOLANA/ETHERSCAN/ALCHEMY/INFURA. Stolen data is exfiltrated by GET/POST to https://api.telegram.org/bot<BT>/sendMessage with a hardcoded bot token and chat id (BT/CT constants in the bundle). The same module also rewrites ~/.config/solana/cli/config.yml jsonrpcurl to http://104.239.66.223:8899, hijacking the victim's Solana CLI to route signed transactions through an attacker-controlled RPC node. A sh() helper invokes childprocess.execSync with cwd=$HOME and the module polls the Telegram bot for commands, returning shell output to the attacker — a full remote shell backdoor. Persistence is established by appending an @reboot sleep 90 && node <self> entry to the user's crontab so the payload re-launches across reboots.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-005418",
            "sha256": "202fa4daf22c4ecace931dfbdbeee6821fe42c14956d35c763c55051528dee12",
            "import_time": "2026-06-11T03:48:48.865468604Z",
            "modified_time": "2026-06-11T02:58:17Z",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ]
        },
        {
            "import_time": "2026-06-11T03:48:48.971932125Z",
            "sha256": "65a5cce495647c979c3983e1cdd2a9049b8ba484a05e5f201bb7e10bc9dd571e",
            "modified_time": "2026-06-11T02:58:21Z",
            "versions": [
                "1.0.2"
            ],
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-005419"
        },
        {
            "id": "IN-MAL-2026-005420",
            "sha256": "c45c7686460eaf5f532a9b90f84e6e447d0661657aaf11994acfe77954f3ef91",
            "import_time": "2026-06-11T03:48:49.093378343Z",
            "modified_time": "2026-06-11T02:58:24Z",
            "source": "amazon-inspector",
            "versions": [
                "1.0.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / solana-web3-community

Package

Name
solana-web3-community
View open source insights on deps.dev
Purl
pkg:npm/solana-web3-community

Affected ranges

Affected versions

1.*
1.0.0
1.0.1
1.0.2

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
indicators 
{
    "package_integrity": [
        {
            "filename": "solana-web3-community-1.0.0.tgz",
            "hashes": {
                "sha1": "e665c2da5e56d9533328838e0ce15bb630f793c0",
                "sha512_sri": "sha512-GidGD1g02cLwF7g+frE9dnJdw8ZhhB5nlwIIgrjSM5sN8yLrkoBpRtdaNT/LqVte7AC4sYKtiqZLwcfTey4T8Q=="
            }
        }
    ],
    "evidence_files": [
        {
            "tlsh": "6584b3097af260a249a330661f2b6485a736d007350cd8757dce93742f5ebbc86b7fa4",
            "sha256": "ca38d13a3f027cbce30da11b5ae9cd7e51015db53cac6eeafef504cc830455ca",
            "path": "lib/index.cjs.js"
        },
        {
            "tlsh": "c9512125ce4a8ca31ec4276e68bd51437661c41b8e94f80c33cb650c8f4daaf257d62e",
            "sha256": "a360bf4e288783e071d8a7dfc6be180cc640fecbf739d858a42cf2f868f7b7c5",
            "path": "package.json"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/solana-web3-community/MAL-2026-5560.json"