{"id":"MAL-2026-13351","summary":"Malicious code in spl-token-utils (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (f95b625c92e85b1c0d5c10a192c70f8f82cf8d3b2ac7b66c034635b680785654)\nOn require, index.js serializes the full process.env together with hostname, username, homedir, platform, cwd, and package metadata, base64-encodes the payload, and sends it via an HTTPS GET to api.telegram.org/bot\u003credacted\u003e/sendMessage with a hardcoded chat_id (8969499041). A marker file in the OS tmpdir suppresses repeat sends. The package presents itself as a drop-in replacement for @solana/spl-token and attempts to require and re-export the real @solana/spl-token so consumers see functional behavior while the exfiltration has already fired. Bulk process.env harvest at import time captures whatever credentials the installer's Node process has in environment — cloud keys, CI/publish tokens, database URLs — none of which relate to any legitimate SPL/Solana utility function. The typosquat name (spl-token-utils vs @solana/spl-token) makes accidental installs likely.\n","modified":"2026-08-05T16:51:08.780827316Z","published":"2026-08-05T15:39:00Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-08-05T16:13:44.461778488Z","modified_time":"2026-08-05T15:39:00Z","sha256":"f95b625c92e85b1c0d5c10a192c70f8f82cf8d3b2ac7b66c034635b680785654","source":"amazon-inspector","versions":["1.4.2"],"id":"IN-MAL-2026-015780"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/spl-token-utils/v/1.4.2"}],"affected":[{"package":{"name":"spl-token-utils","ecosystem":"npm","purl":"pkg:npm/spl-token-utils"},"versions":["1.4.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"package_integrity":[{"filename":"spl-token-utils-1.4.2.tgz","hashes":{"sha1":"dbd09f3b9ee447dc59ab65a5de488c532d4b5b9b","sha512_sri":"sha512-C6kn6gm9Zu15m5rPCeczJgi/MYZmPNtntI7E4M7GGncdbVpgRVnwHpNz1UvHY7oE+EyDSj0rf+N11tj/GQunoA=="}}],"evidence_files":[{"tlsh":"4221229c27f1ba4e12326492652f610a72bbc9f10488f654d598d1c73f702c8da66798","path":"index.js","sha256":"7e9343c88b6d2f9c864022f72b3630afc7d8fb8f32f507cbfd92b171aee7471c"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/spl-token-utils/MAL-2026-13351.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}