{"id":"MAL-2026-16300","summary":"Malicious code in @baanx/solana-lib (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (6462ecac2764fc9cf78d47ee57fec1fd3d6a0cf573ee02eaddcc2e5b5f3f0d7e)\nThe package declares `scripts.install` = `node index.js`, so `npm install @baanx/solana-lib` automatically executes `index.js`, which loads `lib/core.js`. That module reads the installer's username (`os.userInfo().username`), hostname (`os.hostname()`), and current working directory basename, concatenates them with a timestamp and the static prefix `bxsol`, and issues a `dns.resolve4()` lookup against `\u003cprefix\u003e.\u003cuser\u003e.\u003chost\u003e.\u003ccwd\u003e.\u003cts\u003e.oob.algamil7x.xyz` — a DNS-based out-of-band beacon that leaks installer identity to a hardcoded non-first-party domain. Helper modules `lib/e5f0a2.js` and `lib/f6a1b3.js` reconstruct the strings `os`, `dns`, `userInfo`, `hostname`, `cwd`, `resolve4`, the prefix `bxsol`, and the destination host `oob.algamil7x.xyz` from `String.fromCharCode` byte arrays, and load Node builtins indirectly via `module.constructor._load('os')` / `_load('dns')` to conceal the behavior. The package is presented as a Solana library; the char-code-obfuscated destination and the install-time host-recon beacon are inconsistent with any legitimate Solana functionality.\n","modified":"2026-09-21T03:30:16.586381660Z","published":"2026-09-21T03:09:52Z","database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-020204","import_time":"2026-09-21T03:24:21.12515012Z","modified_time":"2026-09-21T03:09:52Z","sha256":"6462ecac2764fc9cf78d47ee57fec1fd3d6a0cf573ee02eaddcc2e5b5f3f0d7e","source":"amazon-inspector","versions":["9.9.10"]}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@baanx/solana-lib/v/9.9.10"}],"affected":[{"package":{"name":"@baanx/solana-lib","ecosystem":"npm","purl":"pkg:npm/%40baanx/solana-lib"},"versions":["9.9.10"],"database_specific":{"indicators":{"evidence_files":[{"path":"lib/core.js","sha256":"6b930c020246e5d616d754ba88c612a92ace1b5b51dc26cedd0bb0032d6faef4","tlsh":"36f0a229b3a3c08fa7e092d0361a43d18459c3c0d7cf4191fb7c0e87904e7d1cac596a"},{"sha256":"722c82e72c54a47cc5390ee243e7a19f3843ce3d5759751f9a05b31a2c2d7f49","tlsh":"efe0201b25afe14fa6e85ee72f17d4dac8920e00e21d4bd9f91d0687206a007c0c0770","path":"lib/f6a1b3.js"}],"package_integrity":[{"filename":"solana-lib-9.9.10.tgz","hashes":{"sha1":"b87b5380d6227dfaf0bd7ef43fb1840f1b4bddaf","sha512_sri":"sha512-l/huo77kYbinGs6lKg46g54IdORPVKMZywhfgvirXWCtDXy1N3GQpt7lP+kZEHUq8FLEN1tqdFY+AxgEWbP12Q=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@baanx/solana-lib/MAL-2026-16300.json","cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}]}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}