{"id":"MAL-2026-10901","summary":"Malicious code in solana-web3-lts (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (51efd3d5cdcb8fb794a1702f586abd7018d86aad3e40286f5a43dd1127d804ed)\nPackage name 'solana-web3-lts' resembles the widely-used '@solana/web3.js' Solana SDK, raising name-confusion concerns for installers reaching for the official client. The shipped library bundles (lib/index.cjs.js, lib/index.esm.js) contain co-occurring use of child_process, fetch/POST/GET, and shell utilities (curl, ping) within large minified files; pattern-level signals match exfiltration shapes but full semantic tracing of the bundle did not complete, so it is not confirmed whether these primitives are reachable from an install/import path or are part of legitimate SDK functionality (e.g., RPC HTTP transports, build tooling). Recommend human review of the bundle to determine whether the child_process + network combination represents a hardcoded C2 exfiltration path or benign SDK code, and to confirm the package's relationship (if any) to the official Solana web3 client.\n","aliases":["GHSA-8wj2-r9xj-g9p3"],"modified":"2026-09-01T11:31:01.692583709Z","published":"2026-07-20T10:59:24Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-07-20T13:14:51.946026412Z","modified_time":"2026-07-20T10:59:24Z","sha256":"17de020deed3039d0004c8c7d53de909c604e25b233c3e2ff6ab6586fa781967","source":"reversing-labs","versions":["1.0.0"],"id":"RLMA-2026-05623"},{"id":"IN-MAL-2026-012967","import_time":"2026-08-05T06:00:25.61805043Z","modified_time":"2026-08-05T05:14:49Z","sha256":"51efd3d5cdcb8fb794a1702f586abd7018d86aad3e40286f5a43dd1127d804ed","source":"amazon-inspector","versions":["1.0.0"]},{"import_time":"2026-09-01T11:18:25.110990996Z","modified_time":"2026-08-24T17:11:41Z","sha256":"73c314527cacf33dbf9e3853afe7c7f75e51e8137b2b09c4f5a89f27132bd68e","source":"reversing-labs","id":"RLUA-2026-06504"}]},"references":[{"type":"WEB","url":"https://research.jfrog.com/post/solana-fakefix"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/solana-web3-lts/v/1.0.0"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-8wj2-r9xj-g9p3"}],"affected":[{"package":{"name":"solana-web3-lts","ecosystem":"npm","purl":"pkg:npm/solana-web3-lts"},"versions":["1.0.0"],"database_specific":{"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"package_integrity":[{"hashes":{"sha1":"b7624c4e9b0473a08ed55e95bd86f2ae0c778179","sha512_sri":"sha512-Vp7uB/pQuhl5ZVFEWaG+Ix2Er1FDnPNtc2m9/uS3Nfv7L4bcB5Be2eE1tPN1shyTx/TEPK7XPfTZRVqpX2OUZg=="},"filename":"solana-web3-lts-1.0.0.tgz"}],"evidence_files":[{"tlsh":"1c74a2097af260a2499330a61f2b6485a736d007350cd8757dce93742f5ebbc86b7fa4","path":"lib/index.cjs.js","sha256":"f5d62c50dac9bc82c50b7b5a3b230009127f1f4b04d766db109fcb7a80b86262"},{"path":"lib/index.esm.js","sha256":"84138890f476d20b59bb586f2f24856c61ba20d389984718c1b33a7b94e67c24","tlsh":"ae74b4497af221a20d5330a66f2b6045a736a107390cdc647dce93641f5ebbc87b7fa4"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/solana-web3-lts/MAL-2026-10901.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"ReversingLabs","contact":["https://www.reversinglabs.com"],"type":"FINDER"}]}