MAL-2026-5560

See a problem?

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/solana-web3-community/MAL-2026-5560.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2026-5560

Published

2026-06-11T02:58:17Z

Modified

2026-08-05T06:36:29.764842576Z

Summary

Malicious code in solana-web3-community (npm)

Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (202fa4daf22c4ecace931dfbdbeee6821fe42c14956d35c763c55051528dee12)

Package masquerades as the official @solana/web3.js SDK (name solana-web3-community, author 'Solana Labs Maintainers maintainers@solanalabs.com', repository solana-foundation/solana-web3.js, homepage solana.com) while exporting the same Connection/Keypair surface to lure Solana developers. On import, lib/index.cjs.js (and the ESM twin lib/index.esm.js) executes a credential-stealing payload that reads ~/.config/solana/id.json, ~/.ssh/idrsa, ~/.aws/credentials, and project.env files, and iterates process.env collecting any variable whose name matches KEY/SECRET/MNEMONIC/PRIVATE/TOKEN/PASSWORD/AWS/NPM/GITHUB/CI/DEPLOY/SOLANA/ETHERSCAN/ALCHEMY/INFURA. Stolen data is exfiltrated by GET/POST to https://api.telegram.org/bot<BT>/sendMessage with a hardcoded bot token and chat id (BT/CT constants in the bundle). The same module also rewrites ~/.config/solana/cli/config.yml jsonrpcurl to http://104.239.66.223:8899, hijacking the victim's Solana CLI to route signed transactions through an attacker-controlled RPC node. A sh() helper invokes childprocess.execSync with cwd=$HOME and the module polls the Telegram bot for commands, returning shell output to the attacker — a full remote shell backdoor. Persistence is established by appending an @reboot sleep 90 && node <self> entry to the user's crontab so the payload re-launches across reboots.

Database specific

{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-005418",
            "import_time": "2026-06-11T03:48:48.865468604Z",
            "sha256": "202fa4daf22c4ecace931dfbdbeee6821fe42c14956d35c763c55051528dee12",
            "modified_time": "2026-06-11T02:58:17Z",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ]
        },
        {
            "id": "IN-MAL-2026-005419",
            "import_time": "2026-06-11T03:48:48.971932125Z",
            "sha256": "65a5cce495647c979c3983e1cdd2a9049b8ba484a05e5f201bb7e10bc9dd571e",
            "versions": [
                "1.0.2"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-06-11T02:58:21Z"
        },
        {
            "id": "IN-MAL-2026-005420",
            "import_time": "2026-06-11T03:48:49.093378343Z",
            "sha256": "c45c7686460eaf5f532a9b90f84e6e447d0661657aaf11994acfe77954f3ef91",
            "modified_time": "2026-06-11T02:58:24Z",
            "source": "amazon-inspector",
            "versions": [
                "1.0.1"
            ]
        },
        {
            "id": "RLMA-2026-05620",
            "import_time": "2026-07-20T13:14:51.660916871Z",
            "sha256": "588804055ed38581a9ecbe940cc24ca01bc3cda94e6492a30ec05bcf7e94c947",
            "versions": [
                "1.0.0",
                "1.0.1",
                "1.0.2",
                "1.0.3",
                "1.0.4",
                "1.0.5"
            ],
            "source": "reversing-labs",
            "modified_time": "2026-07-20T10:59:11Z"
        },
        {
            "id": "IN-MAL-2026-013036",
            "import_time": "2026-08-05T06:00:33.709020322Z",
            "sha256": "6d72194dc9e171231567d5fb3b775b03e24f86237a7f24cd65390eefa06d4baa",
            "modified_time": "2026-08-05T05:24:41Z",
            "source": "amazon-inspector",
            "versions": [
                "1.0.5"
            ]
        },
        {
            "id": "IN-MAL-2026-013033",
            "import_time": "2026-08-05T06:00:33.389907832Z",
            "sha256": "7bda905c77f9ae9e65228c3273430b1249f2e2069837be383cf4e1393ba84948",
            "versions": [
                "1.0.4"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T05:24:14Z"
        },
        {
            "id": "IN-MAL-2026-013035",
            "import_time": "2026-08-05T06:00:33.604004433Z",
            "sha256": "d4fdad2194a0a9fbecc967eb8e1b86d71bddfa5e9461c7eec1e534f57bb3cda5",
            "versions": [
                "1.0.3"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T05:24:34Z"
        }
    ]
}

References

Credits

- Amazon Inspector - FINDER
- - inspector-research@amazon.com
- ReversingLabs - FINDER
- - https://www.reversinglabs.com

Affected packages

npm / solana-web3-community

Package

Name: solana-web3-community; View open source insights on deps.dev
Purl: pkg:npm/solana-web3-community

Affected ranges

Affected versions

1.*

1.0.0

1.0.1

1.0.2

1.0.3

1.0.4

1.0.5

Database specific

cwes

[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]

indicators

{
    "evidence_files": [
        {
            "path": "lib/index.cjs.js",
            "tlsh": "6584b3097af260a249a330661f2b6485a736d007350cd8757dce93742f5ebbc86b7fa4",
            "sha256": "ca38d13a3f027cbce30da11b5ae9cd7e51015db53cac6eeafef504cc830455ca"
        },
        {
            "path": "package.json",
            "tlsh": "c9512125ce4a8ca31ec4276e68bd51437661c41b8e94f80c33cb650c8f4daaf257d62e",
            "sha256": "a360bf4e288783e071d8a7dfc6be180cc640fecbf739d858a42cf2f868f7b7c5"
        }
    ],
    "package_integrity": [
        {
            "filename": "solana-web3-community-1.0.0.tgz",
            "hashes": {
                "sha1": "e665c2da5e56d9533328838e0ce15bb630f793c0",
                "sha512_sri": "sha512-GidGD1g02cLwF7g+frE9dnJdw8ZhhB5nlwIIgrjSM5sN8yLrkoBpRtdaNT/LqVte7AC4sYKtiqZLwcfTey4T8Q=="
            }
        }
    ]
}

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/solana-web3-community/MAL-2026-5560.json"