{"id":"MAL-2025-6971","summary":"Malicious code in solana-pump-sdk (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ossf-package-analysis (45d581c17210e8be2e111136cc9853e7c698eaabd46c44482037ba1436c5b9a0)\nThe OpenSSF Package Analysis project identified 'solana-pump-sdk' @ 1.4.0 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package executes one or more commands associated with malicious behavior.\n","modified":"2025-08-29T06:43:17Z","published":"2025-08-13T11:55:52Z","database_specific":{"malicious-packages-origins":[{"versions":["1.4.0"],"import_time":"2025-08-18T06:09:44.812829389Z","modified_time":"2025-08-13T13:18:49Z","sha256":"45d581c17210e8be2e111136cc9853e7c698eaabd46c44482037ba1436c5b9a0","source":"ossf-package-analysis"},{"modified_time":"2025-08-13T11:55:52Z","sha256":"eeaf158c01c857ee023e9a8f3d66165e83b4566088b57136fd8cdf352144f156","source":"ossf-package-analysis","versions":["1.3.3"],"import_time":"2025-08-18T06:09:44.64717801Z"},{"versions":["1.1.0","1.2.0","1.2.1","1.2.3","1.2.5","1.2.6","1.2.7","1.3.1","1.3.2","1.3.3","1.3.4","1.4.0","1.4.2","1.4.4","2.1.0","2.2.0","2.3.0","2.3.1"],"id":"RLMA-2025-04690","import_time":"2025-08-29T06:42:36.750768843Z","modified_time":"2025-08-28T07:40:44Z","sha256":"6020d9a318bc97b41c56f37aa0dc3de280883755b6812d785b1cad100a707fcc","source":"reversing-labs"}]},"references":[{"type":"WEB","url":"https://getsafety.com/blog-posts/infostealer-targets-russian-crypto-developers"}],"affected":[{"package":{"name":"solana-pump-sdk","ecosystem":"npm","purl":"pkg:npm/solana-pump-sdk"},"versions":["1.4.0","1.3.3","1.1.0","1.2.0","1.2.1","1.2.3","1.2.5","1.2.6","1.2.7","1.3.1","1.3.2","1.3.4","1.4.2","1.4.4","2.1.0","2.2.0","2.3.0","2.3.1"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/solana-pump-sdk/MAL-2025-6971.json"}}],"schema_version":"1.7.3","credits":[{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"},{"name":"ReversingLabs","contact":["https://www.reversinglabs.com"],"type":"FINDER"}]}