{"id":"MAL-2026-10591","summary":"Malicious code in solana-key-utils (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (68b4680547530fce361014fe8c228734a8ec33bc8c834f46285e371e8f6b9f92)\nOn require(), index.js waits 37 seconds, reads test/fixtures/keypairs.dat (a 53KB base64 blob disguised as a test fixture, no test harness references it), base64-decodes it to ~39KB of opaque JavaScript, writes the result to ~/.cache-db/.node-sync/syncd.js with mode 0700, and spawns 'node syncd.js' detached with stdio ignored. The package then installs scheduled persistence on all three major platforms: a crontab entry running the dropped script every 12 hours on Linux, a scheduled task named 'WinNodeSync' on Windows via schtasks, and a LaunchAgent at ~/Library/LaunchAgents/com.apple.syncd.plist on macOS with RunAtLoad and StartInterval 43200. The dropped payload then re-executes every 12 hours independent of the original require, giving whoever published the package persistent code execution on the installer's machine. The 'solana-key-utils' name and 'test fixture' framing are cover for the smuggled executable payload.\n","modified":"2026-07-15T09:19:28.194941427Z","published":"2026-07-14T13:58:15Z","database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","sha256":"1e3abea52b0179f961bc14d9c33dd5c95569c215b21852470a3282cf2a1ddc6c","import_time":"2026-07-14T14:37:51.88679259Z","id":"IN-MAL-2026-010509","modified_time":"2026-07-14T13:58:26Z","versions":["1.0.2"]},{"sha256":"68b4680547530fce361014fe8c228734a8ec33bc8c834f46285e371e8f6b9f92","import_time":"2026-07-14T14:37:51.784631326Z","id":"IN-MAL-2026-010508","modified_time":"2026-07-14T13:58:15Z","versions":["1.0.1"],"source":"amazon-inspector"},{"id":"IN-MAL-2026-010525","modified_time":"2026-07-14T16:45:09Z","versions":["1.0.3"],"source":"amazon-inspector","sha256":"e335b56f5c3bb36be08872fefb6fbdc8d065a5365ae5ab1c55b609bb715e9a13","import_time":"2026-07-14T16:58:36.951429373Z"},{"import_time":"2026-07-15T08:51:06.735034887Z","id":"IN-MAL-2026-010660","modified_time":"2026-07-15T08:15:17Z","versions":["1.0.0"],"source":"amazon-inspector","sha256":"f2c457089861607b22a6e24803c7377e34df30962338fa4a9aa0a8f01ac9835b"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/solana-key-utils/v/1.0.2"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/solana-key-utils/v/1.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/solana-key-utils/v/1.0.3"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/solana-key-utils/v/1.0.0"}],"affected":[{"package":{"name":"solana-key-utils","ecosystem":"npm","purl":"pkg:npm/solana-key-utils"},"versions":["1.0.2","1.0.1","1.0.3","1.0.0"],"database_specific":{"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"tlsh":"8051197137126137530130d338b6ed86d9f94730f41895c8c9cec4c71a82ed84ab9772","path":"index.js","sha256":"a3d377d0dd317a0575c4d733b8303804d0923c735c3e647c7387bc89aa28fc0e"},{"tlsh":"193301b145ae62df237c6aa658cf7880ac6e2ad56ca825c11bc0917a54fc710ff3f034","path":"test/fixtures/keypairs.dat","sha256":"75f8bbd9c51bad2d4c1d160391317595a8d033003e87067a3b2e0dd9811373cd"}],"package_integrity":[{"filename":"solana-key-utils-1.0.2.tgz","hashes":{"sha512_sri":"sha512-qRfG8zqCHNjtHfRhJucDSIvBK73Ig/JotrOciqJbM9QDdFdpMoFXvJygfjxk82Jm3kc8wvXvjr01XC/ANDS7pQ==","sha1":"c5dafe1b67332fcede7302538da21e4b38e828c3"}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/solana-key-utils/MAL-2026-10591.json"}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}