{"id":"MAL-2026-11532","summary":"Malicious code in @zzzgenesis00/solana-wallet-adapter (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (313cd424f27cb12cf28c0ad6737c2b2d5b08ff37d8971ae65a3a0184a73d2c46)\nThe postinstall.js script, which runs automatically on `npm install`, harvests a broad set of installer-owned secrets and identity data and exfiltrates them to two hardcoded attacker-controlled destinations. Collected data includes sensitive environment variables (NPM_TOKEN, NODE_AUTH_TOKEN, GITHUB_TOKEN, AWS_*, HELIUS/INFURA/ALCHEMY keys, MNEMONIC, SEED_PHRASE, SOLANA_PRIVATE_KEY, and similar), the contents of ~/.ssh, ~/.npmrc, and ~/.gitconfig, Chrome/Firefox profile artifacts (Cookies, Login Data, key4.db), the output of `npm whoami` and `git config`, and listings of common wallet directories (.bitcoin,.ethereum,.solana,.metamask,.exodus,.electrum). About 1.5-3.5 seconds after postinstall start, the harvested JSON is sent via HTTPS GET to `api.telegram.org` using a hardcoded bot token and chat_id (bot/chat 7231970337) and via HTTPS POST to `40f955f39128bd79-178-249-214-24.serveousercontent.com/collect` (a Serveo tunnel). The package impersonates the anza-xyz Solana publisher via a false `author` field and a non-existent repository link, wraps the harvester in mangled identifiers (_stq/_dgx/_uiz/_cp/_ht/_tk/_ch/_co/_ex) with a cover-story comment 'postinstall environment verification', and re-exports `./index.js` to appear functional. The stated wallet-adapter purpose does not justify any of the observed reads.\n","modified":"2026-08-04T23:04:47.671510380Z","published":"2026-08-04T22:08:32Z","database_specific":{"malicious-packages-origins":[{"sha256":"313cd424f27cb12cf28c0ad6737c2b2d5b08ff37d8971ae65a3a0184a73d2c46","source":"amazon-inspector","versions":["0.18.0"],"id":"IN-MAL-2026-011348","import_time":"2026-08-04T22:30:12.025231413Z","modified_time":"2026-08-04T22:08:32Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@zzzgenesis00/solana-wallet-adapter/v/0.18.0"}],"affected":[{"package":{"name":"@zzzgenesis00/solana-wallet-adapter","ecosystem":"npm","purl":"pkg:npm/%40zzzgenesis00/solana-wallet-adapter"},"versions":["0.18.0"],"database_specific":{"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"indicators":{"package_integrity":[{"filename":"solana-wallet-adapter-0.18.0.tgz","hashes":{"sha1":"8d0a6a3c9b2554bfc83b8fe86fa853a05c3d63ce","sha512_sri":"sha512-JVlJRjIxcxL50ZqxMiBMeh/pgnDysH6inl8ucxf0+TVPBwgRxLUa6ug9L/MdQZy4iTJ5XsnZ1b89UOiuhY4H/w=="}}],"evidence_files":[{"sha256":"8286413c6cc63a2df835068445cd31e1ecc7c55114bc1c1ac759bdbc7ed5c53f","tlsh":"cfd1859a22e603196852a96dc75f40341672e1033820fbf47ece0b516f4e92cdbb57bd","path":"postinstall.js"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@zzzgenesis00/solana-wallet-adapter/MAL-2026-11532.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}