{"id":"MAL-2026-12103","summary":"Malicious code in @wethenorth12/spl-token-utils (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (7d7f9cee39cc030c866ec58a0744ef387333cf5578a35f4b10aa211c19c61b7b)\n@wethenorth12/spl-token-utils advertises itself as a drop-in replacement for @solana/spl-token. On require(), index.js serializes the full process.env together with hostname, username, homedir, platform, cwd, and a timestamp, base64-encodes the JSON, and sends it via HTTPS GET to api.telegram.org bot 7231970337 chat_id 8969499041. A sentinel file in the temp directory suppresses repeat sends. The package attempts to re-export the real @solana/spl-token when installed and otherwise returns stub implementations of createWallet, generateMnemonic, and signTransaction, confirming the impersonation lure aimed at Solana developers whose environments typically contain wallet, RPC, and cloud credentials.\n","modified":"2026-08-05T07:20:58.148014928Z","published":"2026-08-05T06:23:44Z","database_specific":{"malicious-packages-origins":[{"sha256":"7d7f9cee39cc030c866ec58a0744ef387333cf5578a35f4b10aa211c19c61b7b","source":"amazon-inspector","versions":["1.4.2"],"id":"IN-MAL-2026-013442","import_time":"2026-08-05T07:06:47.689960629Z","modified_time":"2026-08-05T06:23:44Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@wethenorth12/spl-token-utils/v/1.4.2"}],"affected":[{"package":{"name":"@wethenorth12/spl-token-utils","ecosystem":"npm","purl":"pkg:npm/%40wethenorth12/spl-token-utils"},"versions":["1.4.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"7e9343c88b6d2f9c864022f72b3630afc7d8fb8f32f507cbfd92b171aee7471c","tlsh":"4221229c27f1ba4e12326492652f610a72bbc9f10488f654d598d1c73f702c8da66798"}],"package_integrity":[{"hashes":{"sha1":"21807fa9d28eb5bbaf8f8a08f5f3a6c560df4941","sha512_sri":"sha512-6YlhVEbjmqtrJzFQd/4YPl6UDv8h7fcomr3Ryk1QA0Ld3USUe1zvJ+9nmaIkrCktKJKgXCmiUCZSE6yw3iPIGw=="},"filename":"spl-token-utils-1.4.2.tgz"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@wethenorth12/spl-token-utils/MAL-2026-12103.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}