{"id":"MAL-2026-10899","summary":"Malicious code in solana-web3-fixed (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (2d36c0e75143828e4a93135d0c54fb34dd6e75588a493ade663a1fa4b231230c)\nPackage name 'solana-web3-fixed' resembles a fix-branded variant of the legitimate '@solana/web3.js' library, a pattern frequently used in lure/typosquat campaigns. The bundled main files (lib/index.cjs.js and lib/index.esm.js) trigger multiple keyword co-occurrence patterns associated with credential exfiltration: require('child_process') alongside POST/GET fetch calls and shell utilities (curl, ping). Without traced-code corroboration, these patterns cannot be conclusively attributed to either malicious behavior or legitimate Solana RPC / build tooling composition inside a minified bundle. Given the high-risk naming pattern (fix-branded variant of a top-tier crypto library) and the stacked critical static signals across both CJS and ESM bundles, this should be reviewed by a human before being trusted in any installer pipeline.\n","aliases":["GHSA-vc55-fvgr-m9jv"],"modified":"2026-09-01T11:30:56.444780600Z","published":"2026-07-20T10:59:12Z","database_specific":{"malicious-packages-origins":[{"source":"reversing-labs","versions":["1.0.0"],"id":"RLMA-2026-05621","import_time":"2026-07-20T13:14:51.73545303Z","modified_time":"2026-07-20T10:59:12Z","sha256":"213a28e690408d4d3356af127ab0c98a9d663a390c9ab07a980459ea9644ca3b"},{"import_time":"2026-08-05T06:00:25.438718486Z","modified_time":"2026-08-05T05:14:40Z","sha256":"2d36c0e75143828e4a93135d0c54fb34dd6e75588a493ade663a1fa4b231230c","source":"amazon-inspector","versions":["1.0.0"],"id":"IN-MAL-2026-012966"},{"modified_time":"2026-08-24T17:11:29Z","sha256":"51b6e0a86bdacbadc2271559f93ff7173c6d5a1fcaaa0b6514db59a819099d6c","source":"reversing-labs","id":"RLUA-2026-06502","import_time":"2026-09-01T11:18:24.990304523Z"}]},"references":[{"type":"WEB","url":"https://research.jfrog.com/post/solana-fakefix"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/solana-web3-fixed/v/1.0.0"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-vc55-fvgr-m9jv"}],"affected":[{"package":{"name":"solana-web3-fixed","ecosystem":"npm","purl":"pkg:npm/solana-web3-fixed"},"versions":["1.0.0"],"database_specific":{"indicators":{"evidence_files":[{"sha256":"f5d62c50dac9bc82c50b7b5a3b230009127f1f4b04d766db109fcb7a80b86262","tlsh":"1c74a2097af260a2499330a61f2b6485a736d007350cd8757dce93742f5ebbc86b7fa4","path":"lib/index.cjs.js"},{"sha256":"84138890f476d20b59bb586f2f24856c61ba20d389984718c1b33a7b94e67c24","tlsh":"ae74b4497af221a20d5330a66f2b6045a736a107390cdc647dce93641f5ebbc87b7fa4","path":"lib/index.esm.js"}],"package_integrity":[{"filename":"solana-web3-fixed-1.0.0.tgz","hashes":{"sha512_sri":"sha512-vzQaMhhW9iEuDX/qxWlcfB6r5NHPN1F7kPWCCvNY82/vlEvGwS9otRG+diecZPpgnxhFvRHGglI5F48qKkExKQ==","sha1":"07c5c9059567495424c208a5462e3a51f3fcf5ce"}}]},"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/solana-web3-fixed/MAL-2026-10899.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"ReversingLabs","contact":["https://www.reversinglabs.com"],"type":"FINDER"}]}