{"id":"MAL-2026-5787","summary":"Malicious code in @solana-labs/spl-toke (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (8e2ec34996ab8cff20d9ba12cd9f5a8a75346c4e5e25d7c3fd5adc7bb7045f64)\nPackage name `@solana-labs/spl-toke` is a likely confusion-attack against the well-known `@solana/spl-token` SPL token client (missing trailing `n`, different scope). The shipped `lib/index.cjs.js` and `lib/index.esm.js` bundles contain the keyword combinations `fetch(` / `POST` / `https.get` / `ping` that pattern-matched as potential C2 / exfiltration shapes, but tracing of the minified bundle did not complete and the literal destination URLs and trigger paths could not be confirmed in this run. The `ping` token may be benign (e.g. a websocket keepalive method or solana RPC ping helper) and the `fetch` calls may be ordinary RPC traffic — but neither has been verified, and combined with the typosquat-shaped name on a high-value scope (`@solana-labs/*` mimicking the official `solana-labs` GitHub org and the canonical `@solana/spl-token` package), this needs human review before installer use.\n","aliases":["GHSA-6465-92w6-mgp8"],"modified":"2026-09-01T11:30:53.236724092Z","published":"2026-06-15T17:15:36Z","database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-006587","import_time":"2026-06-15T17:22:52.468191324Z","modified_time":"2026-06-15T17:15:46Z","sha256":"0a75812030937ae0ecf6c5d267667b2454058a324711bf3280ed3e97eb5f8b5a","source":"amazon-inspector","versions":["1.0.0"]},{"sha256":"f92bf1c5408d5c80d1bb78242f7315df61273713e07dfad4892f01d0c451e916","source":"amazon-inspector","versions":["1.98.112"],"id":"IN-MAL-2026-006575","import_time":"2026-06-15T17:22:51.550001368Z","modified_time":"2026-06-15T17:15:38Z"},{"modified_time":"2026-06-15T17:15:43Z","sha256":"0b23badd2ad9e0607dabb4d58bc78762691e31c58c9b548db11e0543e21d40fc","source":"amazon-inspector","versions":["1.0.8"],"id":"IN-MAL-2026-006581","import_time":"2026-06-15T17:22:51.946454218Z"},{"sha256":"5e83e440dfb72440a6534ecc320ef618b829630c5cb0fbed432f1237fd45f9ec","source":"amazon-inspector","versions":["1.98.111"],"id":"IN-MAL-2026-006577","import_time":"2026-06-15T17:22:51.706654664Z","modified_time":"2026-06-15T17:15:40Z"},{"modified_time":"2026-06-15T17:15:41Z","sha256":"75b8b946808d1c68fd9c479993b8ed19b103030b3d37a6feeba099f6d4c02b62","source":"amazon-inspector","versions":["1.0.10"],"id":"IN-MAL-2026-006579","import_time":"2026-06-15T17:22:51.804434725Z"},{"versions":["1.98.112"],"id":"IN-MAL-2026-006574","import_time":"2026-06-15T17:22:51.488796677Z","modified_time":"2026-06-15T17:15:37Z","sha256":"d10819a7af9f7f0fd57651626b41a13492ba3841206caa870fdcfbbb0516836b","source":"amazon-inspector"},{"id":"IN-MAL-2026-006584","import_time":"2026-06-15T17:22:52.136334677Z","modified_time":"2026-06-15T17:15:44Z","sha256":"96715c34660630d56f91507a3de9fe64c47de50c19afe8de61107ecc78a0ac38","source":"amazon-inspector","versions":["1.0.5"]},{"versions":["1.0.6"],"id":"IN-MAL-2026-006582","import_time":"2026-06-15T17:22:52.013468649Z","modified_time":"2026-06-15T17:15:43Z","sha256":"a91d0a65c4acdc298a7775a0f4a2e3a65dd07ede8c4731fabefce12525ae38e6","source":"amazon-inspector"},{"versions":["1.0.7"],"id":"IN-MAL-2026-006573","import_time":"2026-06-15T17:22:51.427877495Z","modified_time":"2026-06-15T17:15:36Z","sha256":"ae699ea42c65454a0a9fd55bfd47f9eb9647b9a2dcc604ddd4296cf5a72a32ce","source":"amazon-inspector"},{"id":"IN-MAL-2026-006586","import_time":"2026-06-15T17:22:52.315726076Z","modified_time":"2026-06-15T17:15:46Z","sha256":"f4473251be335760795fc2692450b59c06efa8a7227daf3c2d384cd26f1808d5","source":"amazon-inspector","versions":["1.0.0"]},{"import_time":"2026-06-15T17:22:52.182372609Z","modified_time":"2026-06-15T17:15:45Z","sha256":"16921c38f633d6edf7d7207cdc7cb695891a2f6d8cc6f234144a9ca4f3bd90a0","source":"amazon-inspector","versions":["1.0.5"],"id":"IN-MAL-2026-006585"},{"source":"amazon-inspector","versions":["1.0.10"],"id":"IN-MAL-2026-006580","import_time":"2026-06-15T17:22:51.887968003Z","modified_time":"2026-06-15T17:15:42Z","sha256":"1e6354850b8587cc5b396376a5401bbe99f34df134f815a39c9690e37a21e75f"},{"import_time":"2026-06-15T17:22:51.620339983Z","modified_time":"2026-06-15T17:15:39Z","sha256":"490ce5d7e43d8a79aa85bbd24e7140ed074eee472f375092ab9b4cd650ce41f8","source":"amazon-inspector","versions":["1.98.111"],"id":"IN-MAL-2026-006576"},{"sha256":"4c3108856cfed00df1ae55c038ee7354339ba02864924e43baefb1ca13499531","source":"amazon-inspector","versions":["1.0.8"],"id":"IN-MAL-2026-006578","import_time":"2026-06-15T17:22:51.757647988Z","modified_time":"2026-06-15T17:15:41Z"},{"import_time":"2026-06-15T17:22:52.556768058Z","modified_time":"2026-06-15T17:15:47Z","sha256":"6962bb20fc11a76d4a8235c0cf55f36a941167d4cae085e5a391ea7637b8ceb6","source":"amazon-inspector","versions":["1.0.7"],"id":"IN-MAL-2026-006588"},{"id":"IN-MAL-2026-006583","import_time":"2026-06-15T17:22:52.086784048Z","modified_time":"2026-06-15T17:15:44Z","sha256":"e56cb6f556b8a711af49f2feabc153d8d20fc9f410db77a5da2855382f946803","source":"amazon-inspector","versions":["1.0.6"]},{"id":"RLMA-2026-05467","import_time":"2026-07-20T13:14:42.298585853Z","modified_time":"2026-07-20T10:28:15Z","sha256":"bc01c00946b67ed7f24c792e734b53e3ee2445339606f3c375088b1f7b92ccaf","source":"reversing-labs","versions":["1.0.0","1.0.2","1.0.3","1.0.4","1.0.5","1.0.6","1.0.7","1.0.8","1.0.10","1.98.103","1.98.105","1.98.107","1.98.108","1.98.109","1.98.110","1.98.111","1.98.112"]},{"sha256":"8996ddebfde092bd8e1100f01e45fe963327c4c8c403ea67176098b5e2f0e26e","source":"amazon-inspector","versions":["1.98.103"],"id":"IN-MAL-2026-012943","import_time":"2026-08-05T06:00:22.598579409Z","modified_time":"2026-08-05T05:11:30Z"},{"versions":["1.98.108"],"id":"IN-MAL-2026-012977","import_time":"2026-08-05T06:00:26.666860012Z","modified_time":"2026-08-05T05:16:14Z","sha256":"8e2ec34996ab8cff20d9ba12cd9f5a8a75346c4e5e25d7c3fd5adc7bb7045f64","source":"amazon-inspector"},{"source":"amazon-inspector","versions":["1.0.4"],"id":"IN-MAL-2026-012919","import_time":"2026-08-05T06:00:19.809667514Z","modified_time":"2026-08-05T05:07:57Z","sha256":"c1f53529715bb98b15f1131c24a4765f1299459e24b5702df991ba4cf553f1b6"},{"modified_time":"2026-08-05T05:11:59Z","sha256":"f09ab1a7bdb9c54cb863c619655b98bbdfdbde645ed60392c15c118d20442426","source":"amazon-inspector","versions":["1.0.2"],"id":"IN-MAL-2026-012947","import_time":"2026-08-05T06:00:23.072961066Z"},{"id":"IN-MAL-2026-012983","import_time":"2026-08-05T06:00:27.316143629Z","modified_time":"2026-08-05T05:17:07Z","sha256":"0a8c3729a5a54157a3e7ed4d93db482e430156ff3cb550a47867a3c7de6eae5c","source":"amazon-inspector","versions":["1.98.107"]},{"source":"amazon-inspector","versions":["1.98.105"],"id":"IN-MAL-2026-012984","import_time":"2026-08-05T06:00:27.415929343Z","modified_time":"2026-08-05T05:17:16Z","sha256":"2566ae060700bc91103623a762f99328266339c99b06ec2a309eda354267a6e0"},{"modified_time":"2026-08-05T05:15:58Z","sha256":"4db530bb06064fcb6281e9915b52fa876677fe518c249584b59bec0149b48e2d","source":"amazon-inspector","versions":["1.98.110"],"id":"IN-MAL-2026-012975","import_time":"2026-08-05T06:00:26.45761725Z"},{"source":"amazon-inspector","versions":["1.98.109"],"id":"IN-MAL-2026-012940","import_time":"2026-08-05T06:00:22.214526014Z","modified_time":"2026-08-05T05:11:06Z","sha256":"6f9674353cb2d3d209e6e49bca0a12c4189947398600f1a4cdb2a160b7a0dd07"},{"import_time":"2026-09-01T11:17:44.505871485Z","modified_time":"2026-08-24T16:31:00Z","sha256":"784f25ec2ce334256d0768d43c241c8d74c386838e5a69ceb18de07a9bd3a14a","source":"reversing-labs","id":"RLUA-2026-05924"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@solana-labs/spl-toke/v/1.0.10"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@solana-labs/spl-toke/v/1.98.112"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@solana-labs/spl-toke/v/1.0.5"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@solana-labs/spl-toke/v/1.0.6"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@solana-labs/spl-toke/v/1.0.7"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@solana-labs/spl-toke/v/1.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@solana-labs/spl-toke/v/1.98.111"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@solana-labs/spl-toke/v/1.0.8"},{"type":"WEB","url":"https://research.jfrog.com/post/solana-fakefix"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@solana-labs/spl-toke/v/1.98.103"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@solana-labs/spl-toke/v/1.98.108"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@solana-labs/spl-toke/v/1.0.4"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@solana-labs/spl-toke/v/1.0.2"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@solana-labs/spl-toke/v/1.98.107"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@solana-labs/spl-toke/v/1.98.105"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@solana-labs/spl-toke/v/1.98.110"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@solana-labs/spl-toke/v/1.98.109"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-6465-92w6-mgp8"}],"affected":[{"package":{"name":"@solana-labs/spl-toke","ecosystem":"npm","purl":"pkg:npm/%40solana-labs/spl-toke"},"versions":["1.0.0","1.98.112","1.0.8","1.98.111","1.0.10","1.0.5","1.0.6","1.0.7","1.0.2","1.0.3","1.0.4","1.98.103","1.98.105","1.98.107","1.98.108","1.98.109","1.98.110"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"domains":["ifconfig.me","api.telegram.org"],"evidence_files":[{"tlsh":"956207ebbbba93b8c69220745e2fb00754bbb5134d88d148b84cf4412fa834457a7df9","path":"install.js","sha256":"5cf2676da1c145a83b72ff6272aa70be6866bc837a2c468f2c7da71e9b11d428"},{"tlsh":"55e02610cd619d6324c42d9b0db78509191a893b0844b80c3bc3718d8fada3f19fb66e","path":"package.json","sha256":"54830e384595b6e88b1f5c7ccada352690ba66b8b389f84b050e611367c2fa20"}],"ips":["149.154.166.110","10.1.0.2","104.16.9.34","34.160.111.145"],"package_integrity":[{"filename":"spl-toke-1.0.10.tgz","hashes":{"sha512_sri":"sha512-m/Rr01AMHA8WQZK4p+DF8S6gHIBz0qy7Yk1+8PuOGM7K9GjDC8BAD+qEoPFP99Yw9tj/VNghNgkDKw0wpUB5Lg==","sha1":"dcb812e6946a77a1e922c09d6143fbb92608cc43"}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@solana-labs/spl-toke/MAL-2026-5787.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"ReversingLabs","contact":["https://www.reversinglabs.com"],"type":"FINDER"}]}