{"id":"MAL-2026-5560","summary":"Malicious code in solana-web3-community (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (202fa4daf22c4ecace931dfbdbeee6821fe42c14956d35c763c55051528dee12)\nPackage masquerades as the official @solana/web3.js SDK (name solana-web3-community, author 'Solana Labs Maintainers \u003cmaintainers@solanalabs.com\u003e', repository solana-foundation/solana-web3.js, homepage solana.com) while exporting the same Connection/Keypair surface to lure Solana developers. On import, lib/index.cjs.js (and the ESM twin lib/index.esm.js) executes a credential-stealing payload that reads ~/.config/solana/id.json, ~/.ssh/id_rsa, ~/.aws/credentials, and project.env files, and iterates process.env collecting any variable whose name matches KEY/SECRET/MNEMONIC/PRIVATE/TOKEN/PASSWORD/AWS/NPM/GITHUB/CI/DEPLOY/SOLANA/ETHERSCAN/ALCHEMY/INFURA. Stolen data is exfiltrated by GET/POST to https://api.telegram.org/bot\u003cBT\u003e/sendMessage with a hardcoded bot token and chat id (BT/CT constants in the bundle). The same module also rewrites ~/.config/solana/cli/config.yml json_rpc_url to http://104.239.66.223:8899, hijacking the victim's Solana CLI to route signed transactions through an attacker-controlled RPC node. A sh() helper invokes child_process.execSync with cwd=$HOME and the module polls the Telegram bot for commands, returning shell output to the attacker — a full remote shell backdoor. Persistence is established by appending an `@reboot sleep 90 && node \u003cself\u003e` entry to the user's crontab so the payload re-launches across reboots.\n","aliases":["GHSA-hrhj-mh9v-hvr8"],"modified":"2026-09-01T11:30:56.478876428Z","published":"2026-06-11T02:58:17Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-06-11T03:48:48.865468604Z","modified_time":"2026-06-11T02:58:17Z","sha256":"202fa4daf22c4ecace931dfbdbeee6821fe42c14956d35c763c55051528dee12","source":"amazon-inspector","versions":["1.0.0"],"id":"IN-MAL-2026-005418"},{"sha256":"65a5cce495647c979c3983e1cdd2a9049b8ba484a05e5f201bb7e10bc9dd571e","source":"amazon-inspector","versions":["1.0.2"],"id":"IN-MAL-2026-005419","import_time":"2026-06-11T03:48:48.971932125Z","modified_time":"2026-06-11T02:58:21Z"},{"modified_time":"2026-06-11T02:58:24Z","sha256":"c45c7686460eaf5f532a9b90f84e6e447d0661657aaf11994acfe77954f3ef91","source":"amazon-inspector","versions":["1.0.1"],"id":"IN-MAL-2026-005420","import_time":"2026-06-11T03:48:49.093378343Z"},{"id":"RLMA-2026-05620","import_time":"2026-07-20T13:14:51.660916871Z","modified_time":"2026-07-20T10:59:11Z","sha256":"588804055ed38581a9ecbe940cc24ca01bc3cda94e6492a30ec05bcf7e94c947","source":"reversing-labs","versions":["1.0.0","1.0.1","1.0.2","1.0.3","1.0.4","1.0.5"]},{"versions":["1.0.5"],"id":"IN-MAL-2026-013036","import_time":"2026-08-05T06:00:33.709020322Z","modified_time":"2026-08-05T05:24:41Z","sha256":"6d72194dc9e171231567d5fb3b775b03e24f86237a7f24cd65390eefa06d4baa","source":"amazon-inspector"},{"modified_time":"2026-08-05T05:24:14Z","sha256":"7bda905c77f9ae9e65228c3273430b1249f2e2069837be383cf4e1393ba84948","source":"amazon-inspector","versions":["1.0.4"],"id":"IN-MAL-2026-013033","import_time":"2026-08-05T06:00:33.389907832Z"},{"source":"amazon-inspector","versions":["1.0.3"],"id":"IN-MAL-2026-013035","import_time":"2026-08-05T06:00:33.604004433Z","modified_time":"2026-08-05T05:24:34Z","sha256":"d4fdad2194a0a9fbecc967eb8e1b86d71bddfa5e9461c7eec1e534f57bb3cda5"},{"sha256":"efa1d1447372422df18fd9199e976dc2eb31b6b252e5e95fda0aa5964772167b","source":"reversing-labs","id":"RLUA-2026-06501","import_time":"2026-09-01T11:18:24.936280514Z","modified_time":"2026-08-24T17:11:29Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/solana-web3-community/v/1.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/solana-web3-community/v/1.0.2"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/solana-web3-community/v/1.0.1"},{"type":"WEB","url":"https://research.jfrog.com/post/solana-fakefix"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/solana-web3-community/v/1.0.5"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/solana-web3-community/v/1.0.4"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/solana-web3-community/v/1.0.3"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-hrhj-mh9v-hvr8"}],"affected":[{"package":{"name":"solana-web3-community","ecosystem":"npm","purl":"pkg:npm/solana-web3-community"},"versions":["1.0.0","1.0.2","1.0.1","1.0.3","1.0.4","1.0.5"],"database_specific":{"indicators":{"evidence_files":[{"path":"lib/index.cjs.js","sha256":"ca38d13a3f027cbce30da11b5ae9cd7e51015db53cac6eeafef504cc830455ca","tlsh":"6584b3097af260a249a330661f2b6485a736d007350cd8757dce93742f5ebbc86b7fa4"},{"sha256":"a360bf4e288783e071d8a7dfc6be180cc640fecbf739d858a42cf2f868f7b7c5","tlsh":"c9512125ce4a8ca31ec4276e68bd51437661c41b8e94f80c33cb650c8f4daaf257d62e","path":"package.json"}],"package_integrity":[{"filename":"solana-web3-community-1.0.0.tgz","hashes":{"sha1":"e665c2da5e56d9533328838e0ce15bb630f793c0","sha512_sri":"sha512-GidGD1g02cLwF7g+frE9dnJdw8ZhhB5nlwIIgrjSM5sN8yLrkoBpRtdaNT/LqVte7AC4sYKtiqZLwcfTey4T8Q=="}}]},"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/solana-web3-community/MAL-2026-5560.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"ReversingLabs","contact":["https://www.reversinglabs.com"],"type":"FINDER"}]}