{"id":"MAL-2026-5362","summary":"Malicious code in @solana-labs/etherjs (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (5c086a8d2c3022bc55743fdca944c8810b997ec203e8742606bf14cccee721db)\nPackage is published as `@solana-labs/etherjs` but its README documents itself as `@solana-labs/web3.js` and instructs consumers to `import { Connection, PublicKey, Keypair } from '@solana-labs/web3.js'` — the legitimate Solana SDK is `@solana/web3.js` (no `-labs`). Developers who copy the README install line land on this package instead. The Node CommonJS and ESM bundles (`lib/index.cjs.js`, `lib/index.esm.js`) are a fork of solana-web3.js with an injected payload that, on `require()`/`import`, reads `process.env` (lines 11365-11366, 11448, 11453, 11542, 11547 in the CJS bundle) and POSTs the harvested data to a hardcoded bare IP `http://104.239.66.223:8899` (line 11384) and to `https://api.telegram.org/bot.../sendMessage` with a fixed `chat_id` (lines 11415-11417). The same blocks repeatedly `require('child_process')` (lines 11441, 11466, 11479, 11495, 11535) and invoke `curl`, enabling attacker-influenced shell execution on the installer host. The browser/native bundles omit the payload, confirming it is gated to Node consumers. Both attacker destinations are hardcoded with no opt-out.\n\n## Source: ossf-package-analysis (f3c9e260b3ed97dca42969f7b7836399ce071c4708cffd473bd6b3cf62925401)\nThe OpenSSF Package Analysis project identified '@solana-labs/etherjs' @ 1.0.0 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n\n- The package executes one or more commands associated with malicious behavior.\n","modified":"2026-06-12T20:01:52.759236676Z","published":"2026-06-07T05:44:38Z","database_specific":{"malicious-packages-origins":[{"sha256":"f3c9e260b3ed97dca42969f7b7836399ce071c4708cffd473bd6b3cf62925401","import_time":"2026-06-09T12:03:47.084681057Z","modified_time":"2026-06-07T05:44:38Z","versions":["1.0.0"],"source":"ossf-package-analysis"},{"import_time":"2026-06-11T03:48:53.240708311Z","id":"IN-MAL-2026-005453","modified_time":"2026-06-11T03:16:26Z","versions":["1.98.111"],"source":"amazon-inspector","sha256":"5c086a8d2c3022bc55743fdca944c8810b997ec203e8742606bf14cccee721db"},{"source":"amazon-inspector","sha256":"87969d62ce8c5d296289915afecd9628f33ba83360c4b120ffca330e91c91cdf","import_time":"2026-06-11T03:48:51.939970699Z","id":"IN-MAL-2026-005443","modified_time":"2026-06-11T03:10:04Z","versions":["1.98.112"]},{"import_time":"2026-06-12T19:44:07.496603517Z","id":"IN-MAL-2026-006095","modified_time":"2026-06-12T19:08:41Z","versions":["1.0.5"],"source":"amazon-inspector","sha256":"dedfddcfb304a9fb1ef7feb17cd25b5cfa0583bcd67b1e634734df250cde357f"},{"id":"IN-MAL-2026-006098","modified_time":"2026-06-12T19:08:46Z","versions":["1.0.8"],"source":"amazon-inspector","sha256":"f524609953350400e7b91186b24cfe6c963a4d056bf2095924e735589d988c5b","import_time":"2026-06-12T19:44:07.804864773Z"},{"sha256":"10bffd4cf9af4c8810a38b392490f26a2ef2e8f2934676f269387346c9faecaf","import_time":"2026-06-12T19:44:07.6078943Z","id":"IN-MAL-2026-006096","modified_time":"2026-06-12T19:08:43Z","versions":["1.0.6"],"source":"amazon-inspector"},{"id":"IN-MAL-2026-006094","modified_time":"2026-06-12T19:08:39Z","versions":["1.0.10"],"source":"amazon-inspector","sha256":"77ffb0e1cfca0e83eba3bde60175625c5d9db1dc2ab2b0ed7c36e371ce65bf7b","import_time":"2026-06-12T19:44:07.376048879Z"},{"import_time":"2026-06-12T19:44:07.182105092Z","id":"IN-MAL-2026-006092","modified_time":"2026-06-12T19:08:38Z","versions":["1.0.0"],"source":"amazon-inspector","sha256":"80dbb609794f06305e091b2be9cc04f38e1d00703b686c006c8ba0297fc6d94c"},{"import_time":"2026-06-12T19:44:07.282518538Z","id":"IN-MAL-2026-006093","modified_time":"2026-06-12T19:08:38Z","versions":["1.0.0"],"source":"amazon-inspector","sha256":"83a814b3dbc6b71ab3b64b1444224ff6cef32e405795d1b2c62a2f4a52c5d1d0"},{"modified_time":"2026-06-12T19:08:44Z","versions":["1.0.7"],"source":"amazon-inspector","sha256":"8af8ac56e711c03e9a4ea0df7cfc05d9971ba5ab772857bb997008dabf578a78","import_time":"2026-06-12T19:44:07.715255559Z","id":"IN-MAL-2026-006097"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@solana-labs/etherjs/v/1.98.111"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@solana-labs/etherjs/v/1.98.112"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@solana-labs/etherjs/v/1.0.5"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@solana-labs/etherjs/v/1.0.8"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@solana-labs/etherjs/v/1.0.6"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@solana-labs/etherjs/v/1.0.10"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@solana-labs/etherjs/v/1.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@solana-labs/etherjs/v/1.0.7"}],"affected":[{"package":{"name":"@solana-labs/etherjs","ecosystem":"npm","purl":"pkg:npm/%40solana-labs%2Fetherjs"},"versions":["1.0.0","1.98.111","1.98.112","1.0.5","1.0.8","1.0.6","1.0.10","1.0.7"],"database_specific":{"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"indicators":{"package_integrity":[{"filename":"etherjs-1.98.111.tgz","hashes":{"sha512_sri":"sha512-rSIC7+wLUtQasShi7W5Bpo9Ko3aQkT8uGmYEWFclnqT7yHoQjxzkpaPG1cko/qfNhWx0ncjTavqYqUbMetpL7g==","sha1":"6b824a6ae60e8c206e9e729626166aceebd8b5c8"}}],"domains":["ifconfig.me","api.telegram.org"],"evidence_files":[{"path":"package.json","sha256":"0bd897a24d4568395194d62574107085f61fdbf7cff72b924547f52d49825aa0","tlsh":"9441f035cd4a8ca35ec4266aa9bd51437661c41b4e95f80c33cb750c8f4daaf227d62e"},{"tlsh":"3c84b2097af260a249a330661f2b6485a736d007350cd8757dce93742f5ebbc86b7fa4","path":"lib/index.cjs.js","sha256":"22f44f38dd5594d4f8bccb223c6db16bc9d7cca18c4b576eb349d943080d6f46"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@solana-labs/etherjs/MAL-2026-5362.json"}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"}]}