{"id":"MAL-2026-5358","summary":"Malicious code in solana-core-4 (npm)","details":"Crypto/SSH/wallet stealer, blockchain-helper-0/web3-tools-9 campaign sibling (c960/c961). postinstall scripts/postinstall.js auto-execs, src/index.js harvests ~/.ssh/id_rsa+wallet keys/seeds+env, self-labels \"CRYPTO STEALER\", exfils to IDENTICAL Telegram bot 8227918239 chat 6433587894 (not rotated). Generic-crypto-name + numeric suffix + 1.0.0 pattern.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (61592bcace57b51c5e1371d9645f1a3ab04ea4d9e148dcacca192ed98e82e36c)\nThe package was found to contain malicious code or consuming dependency that contains malicious code\n\n## Source: ossf-package-analysis (efb376d3542aadcfbbb9f689dcfcd73534f230fbe75ed465327444685097fd6d)\nThe OpenSSF Package Analysis project identified 'solana-core-4' @ 1.0.0 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n","modified":"2026-07-09T23:02:03.684697293Z","published":"2026-06-09T03:26:08Z","database_specific":{"malicious-packages-origins":[{"source":"ossf-package-analysis","sha256":"efb376d3542aadcfbbb9f689dcfcd73534f230fbe75ed465327444685097fd6d","import_time":"2026-06-09T12:03:47.849959932Z","modified_time":"2026-06-09T03:26:08Z","versions":["1.0.0"]},{"sha256":"61592bcace57b51c5e1371d9645f1a3ab04ea4d9e148dcacca192ed98e82e36c","import_time":"2026-07-09T22:56:27.558566627Z","id":"IN-MAL-2026-009488","modified_time":"2026-07-09T22:02:48Z","versions":["1.0.0"],"source":"amazon-inspector"}]},"references":[{"type":"REPORT","url":"https://app.safedep.io/community/malysis/01KTN5C8PDTMRFMHPJX8KW1TNG"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/solana-core-4/v/1.0.0"}],"affected":[{"package":{"name":"solana-core-4","ecosystem":"npm","purl":"pkg:npm/solana-core-4"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["1.0.0"],"database_specific":{"indicators":{"package_integrity":[{"hashes":{"sha1":"8d53d6e72856eaa275f2c940cebc94f1bbc1a0b8","sha512_sri":"sha512-bQg7RyYDlwOoKtz3Na20TMXTUq7p3KgKLY6vF3/xCfkmkuwBEnaB/1fgEurl9lgc6kqLvElqzLbTBsHFiLczzg=="},"filename":"solana-core-4-1.0.0.tgz"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/solana-core-4/MAL-2026-5358.json","cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}]}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"},{"name":"SafeDep","contact":["https://safedep.io"],"type":"FINDER"}]}