{"id":"MAL-2026-5786","summary":"Malicious code in @solana-labs/ancor (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (3265b293c8d6ebf4e866644687ab8bb9f03345c704acf7c885574886ad396b5b)\nPackage is published as `@solana-labs/ancor` — a name one character off from `anchor`, the well-known Solana smart-contract framework (published as `@coral-xyz/anchor`, formerly `@project-serum/anchor`). The `@solana-labs` scope and the near-miss spelling `ancor` together create high confusion potential for developers searching for the Anchor framework. The shipped bundles `lib/index.cjs.js` and `lib/index.esm.js` are large minified rollups (~11k+ lines) that include `require('child_process')`, `fetch(...)` POST calls, and references to `curl` / `ping`. Pattern matches on keyword co-occurrence in a minified bundle do not by themselves prove malicious intent — Anchor and similar frameworks legitimately bundle child_process and HTTP for build/CLI tooling — but the combination of a typosquat-shaped name, a vendor-impersonating scope, and a large opaque bundle warrants human review before this version is allowed into installer environments. A reviewer should verify scope ownership (is `@solana-labs` actually controlled by Solana Labs, or a squatted scope?), de-minify the flagged regions around lines 5016/5046 and 11336/11441 to confirm whether the POST/fetch destinations and child_process spawns are part of a documented build/CLI flow or an exfiltration path, and compare bundle behavior against legitimate `@coral-xyz/anchor`.\n","aliases":["GHSA-h2x5-cj9x-hvcc"],"modified":"2026-09-01T11:30:53.256567015Z","published":"2026-06-15T17:17:17Z","database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","versions":["1.0.1"],"id":"IN-MAL-2026-006600","import_time":"2026-06-15T17:22:53.536535124Z","modified_time":"2026-06-15T17:17:28Z","sha256":"06e80dfe88b6d601c9312c9fc13275b703e5d05311232a3f1fa01b1c0a1f041b"},{"versions":["1.0.1"],"id":"IN-MAL-2026-006599","import_time":"2026-06-15T17:22:53.441442777Z","modified_time":"2026-06-15T17:17:27Z","sha256":"4341f9b2c0176d9259176539e69a12bec21bd872733a220066f2af7e8c852012","source":"amazon-inspector"},{"id":"IN-MAL-2026-006597","import_time":"2026-06-15T17:22:53.323149768Z","modified_time":"2026-06-15T17:17:25Z","sha256":"a2dc1225b1e56ff04b029102d142b130bf7d9f65e2458034cd7ef630dcdaf5eb","source":"amazon-inspector","versions":["1.0.8"]},{"import_time":"2026-06-15T17:22:52.810954547Z","modified_time":"2026-06-15T17:17:22Z","sha256":"e5786abeec93a264217ec9d4ca101ba0f491867bacf387dfd15e891fde36b634","source":"amazon-inspector","versions":["1.0.9"],"id":"IN-MAL-2026-006592"},{"source":"amazon-inspector","versions":["1.0.8"],"id":"IN-MAL-2026-006598","import_time":"2026-06-15T17:22:53.386804733Z","modified_time":"2026-06-15T17:17:25Z","sha256":"0e572d1a61685cd04ccafca460d47a230f0306cca7692e3c1008f2b296592b22"},{"modified_time":"2026-06-15T17:17:18Z","sha256":"3b513d317445b8431eda1751d82e7f50d2d7ef311a9891a7aa9a2fab706236c5","source":"amazon-inspector","versions":["1.0.0"],"id":"IN-MAL-2026-006590","import_time":"2026-06-15T17:22:52.70320754Z"},{"source":"amazon-inspector","versions":["1.0.0"],"id":"IN-MAL-2026-006589","import_time":"2026-06-15T17:22:52.659805192Z","modified_time":"2026-06-15T17:17:17Z","sha256":"3c3f14460d22b93718d3fdf4337cc9b5f3a2526e4cb265a906a9c24d87671f98"},{"import_time":"2026-06-15T17:22:52.929386825Z","modified_time":"2026-06-15T17:17:22Z","sha256":"42c4ffd55383e8703ce8de56e582e1e0eaa2b57d522edb4b4356febd4134e6a5","source":"amazon-inspector","versions":["1.0.11"],"id":"IN-MAL-2026-006593"},{"versions":["1.0.11"],"id":"IN-MAL-2026-006591","import_time":"2026-06-15T17:22:52.749849529Z","modified_time":"2026-06-15T17:17:21Z","sha256":"4d59b87155558b811b79a7d671f6dcd66bee47adff3a7022ab22d73f18d86369","source":"amazon-inspector"},{"import_time":"2026-06-15T17:22:53.05279153Z","modified_time":"2026-06-15T17:17:23Z","sha256":"5feff6d83078f902bd5e7eaa2dd81f78c95289d86ccfcde5f30325c7609278a7","source":"amazon-inspector","versions":["1.0.9"],"id":"IN-MAL-2026-006594"},{"sha256":"8e001b6b18e1b0a1841b10d5e41b1403383d65f61e56f5363efcfc4102162892","source":"amazon-inspector","versions":["1.0.7"],"id":"IN-MAL-2026-006595","import_time":"2026-06-15T17:22:53.174797033Z","modified_time":"2026-06-15T17:17:23Z"},{"sha256":"c2e55c8cd359b7c45614d01f3d8f02bd9f27a9322c52decf65b1524500a0a396","source":"amazon-inspector","versions":["1.0.7"],"id":"IN-MAL-2026-006596","import_time":"2026-06-15T17:22:53.241896585Z","modified_time":"2026-06-15T17:17:24Z"},{"versions":["1.0.0","1.0.1","1.0.3","1.0.4","1.0.5","1.0.6","1.0.7","1.0.8","1.0.9","1.0.11","1.98.103","1.98.105","1.98.107","1.98.108","1.98.109","1.98.110","1.98.111","1.98.112"],"id":"RLMA-2026-05466","import_time":"2026-07-20T13:14:42.204993192Z","modified_time":"2026-07-20T10:28:14Z","sha256":"70c0dda7b6c720ce80dd63fb61128fb18e31dbf5d8c6842fa193ac2390e90b0c","source":"reversing-labs"},{"versions":["1.98.108"],"id":"IN-MAL-2026-012981","import_time":"2026-08-05T06:00:27.088725318Z","modified_time":"2026-08-05T05:16:51Z","sha256":"314cf23ddf6ccc41d2ef7db753d938cb43fa48d9831898121a2242de1bc02705","source":"amazon-inspector"},{"sha256":"3265b293c8d6ebf4e866644687ab8bb9f03345c704acf7c885574886ad396b5b","source":"amazon-inspector","versions":["1.98.110"],"id":"IN-MAL-2026-012972","import_time":"2026-08-05T06:00:26.152164255Z","modified_time":"2026-08-05T05:15:30Z"},{"sha256":"3d9b7772c3a290a2df1dab3f463f81b7858eb46014bdf5894d87085300b27eaa","source":"amazon-inspector","versions":["1.98.109"],"id":"IN-MAL-2026-012978","import_time":"2026-08-05T06:00:26.770716766Z","modified_time":"2026-08-05T05:16:21Z"},{"modified_time":"2026-08-05T05:18:15Z","sha256":"66b793954230a8961373ff13632dea3f9142617883313255138a279d18f135e5","source":"amazon-inspector","versions":["1.0.3"],"id":"IN-MAL-2026-012991","import_time":"2026-08-05T06:00:28.19115161Z"},{"sha256":"c4eb809cfad458ca8ae6023a958903efc0280e4a262fe0494e079edc55ed1baa","source":"amazon-inspector","versions":["1.0.4"],"id":"IN-MAL-2026-012993","import_time":"2026-08-05T06:00:28.464479959Z","modified_time":"2026-08-05T05:18:36Z"},{"id":"IN-MAL-2026-012970","import_time":"2026-08-05T06:00:25.953644442Z","modified_time":"2026-08-05T05:15:15Z","sha256":"2a6b346d7986ec82a886c6b717340b2431585bcb3e7d404ff79ffba00c6e664c","source":"amazon-inspector","versions":["1.98.111"]},{"import_time":"2026-08-05T06:00:27.969796188Z","modified_time":"2026-08-05T05:17:57Z","sha256":"2aa229b377555123d264a04dcedb4380d56b34f88359704038d09d8cfabda744","source":"amazon-inspector","versions":["1.0.5"],"id":"IN-MAL-2026-012989"},{"versions":["1.98.105"],"id":"IN-MAL-2026-012987","import_time":"2026-08-05T06:00:27.74679233Z","modified_time":"2026-08-05T05:17:40Z","sha256":"49b37772a8993dfe253fc690b3d1805738bbfcc124faedd415e4b48c6518fee8","source":"amazon-inspector"},{"versions":["1.98.103"],"id":"IN-MAL-2026-013039","import_time":"2026-08-05T06:00:34.030479588Z","modified_time":"2026-08-05T05:25:11Z","sha256":"adb9cf699c9d3cdc61f5ce194874e12de5a8db37140b162a6c76bb83ee483db1","source":"amazon-inspector"},{"source":"amazon-inspector","versions":["1.98.107"],"id":"IN-MAL-2026-012982","import_time":"2026-08-05T06:00:27.192126204Z","modified_time":"2026-08-05T05:16:58Z","sha256":"ddf942b3608ccb23c6d9fad14219183b15ded3594816b61046127c2c139893e7"},{"id":"RLUA-2026-05923","import_time":"2026-09-01T11:17:44.438722886Z","modified_time":"2026-08-24T16:31:00Z","sha256":"bff942e48bb44f623732af6fad56c959b321c0c9b2e58fa4b897292e22433f2d","source":"reversing-labs"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@solana-labs/ancor/v/1.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@solana-labs/ancor/v/1.0.8"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@solana-labs/ancor/v/1.0.9"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@solana-labs/ancor/v/1.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@solana-labs/ancor/v/1.0.11"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@solana-labs/ancor/v/1.0.7"},{"type":"WEB","url":"https://research.jfrog.com/post/solana-fakefix"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@solana-labs/ancor/v/1.98.108"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@solana-labs/ancor/v/1.98.110"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@solana-labs/ancor/v/1.98.109"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@solana-labs/ancor/v/1.0.3"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@solana-labs/ancor/v/1.0.4"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@solana-labs/ancor/v/1.98.111"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@solana-labs/ancor/v/1.0.5"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@solana-labs/ancor/v/1.98.105"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@solana-labs/ancor/v/1.98.103"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@solana-labs/ancor/v/1.98.107"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-h2x5-cj9x-hvcc"}],"affected":[{"package":{"name":"@solana-labs/ancor","ecosystem":"npm","purl":"pkg:npm/%40solana-labs/ancor"},"versions":["1.0.1","1.0.8","1.0.9","1.0.0","1.0.11","1.0.7","1.0.3","1.0.4","1.0.5","1.0.6","1.98.103","1.98.105","1.98.107","1.98.108","1.98.109","1.98.110","1.98.111","1.98.112"],"database_specific":{"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@solana-labs/ancor/MAL-2026-5786.json","indicators":{"evidence_files":[{"sha256":"26862c85e8b88b8dcf7606678c286130b852dda467257d6e781c1c02293fc913","tlsh":"5a82e8a506fa5a2456a7f6ac3f0f5019251be10b3508ed55b94c8f946f8932883f2fec","path":"install.js"},{"path":"package.json","sha256":"586b641329f23e586cefeef5391e2fe64038b671abc3ea7feb1e27a48a32fd7e","tlsh":"9ad05b641b629d332dc45e9b0d33424d26751d174150744d1b9f3108d19d7b7e8ba62e"}],"ips":["34.160.111.145","149.154.166.110","104.16.10.34","10.1.0.2"],"package_integrity":[{"hashes":{"sha1":"f3a17d5b7ce4972c58a87c9ddff158fe5b4135f4","sha512_sri":"sha512-f5xT6CykjGFIv9VehK/BeEtlU5pl5SQg52hAq+cBj2U6MHhuVQfVUs1tXD1V0BKsTg6EOVANcVx3ED0AlVXbWg=="},"filename":"ancor-1.0.1.tgz"}],"domains":["ifconfig.me","api.telegram.org"]}}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"ReversingLabs","contact":["https://www.reversinglabs.com"],"type":"FINDER"}]}