solana-web3-fork

{"schema_version":"1.7.4","id":"MAL-2026-10900","published":"2026-07-20T10:59:23Z","modified":"2026-09-01T11:20:30.058053500Z","aliases":["GHSA-rf7g-mf44-5m44"],"summary":"Malicious code in solana-web3-fork (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (912cb41aa6b78cf62207dbf95f7d6247238483a800fa9bc6edd9b9d9f7819364)\nPackage name appears to fork or imitate the well-known @solana/web3.js library. Bundled files lib/index.cjs.js and lib/index.esm.js contain co-occurring patterns of child_process usage, fetch/POST/GET calls, and shell utilities (curl, ping) within the same minified bundles. These keyword co-occurrences in a minified Solana SDK fork are concerning but cannot be conclusively distinguished from legitimate SDK behavior (RPC calls, build tooling) without semantic verification of the bundle. Specific hardcoded attacker C2 endpoints, credential-theft paths, or install-time lifecycle hooks have not been confirmed. Given the name-collision with a major crypto SDK and the suspicious pattern stacking in the bundle, manual review is warranted before allowing installer use.\n","affected":[{"package":{"name":"solana-web3-fork","ecosystem":"npm","purl":"pkg:npm/solana-web3-fork"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"lib/index.cjs.js","sha256":"f5d62c50dac9bc82c50b7b5a3b230009127f1f4b04d766db109fcb7a80b86262","tlsh":"1c74a2097af260a2499330a61f2b6485a736d007350cd8757dce93742f5ebbc86b7fa4"},{"path":"lib/index.esm.js","sha256":"84138890f476d20b59bb586f2f24856c61ba20d389984718c1b33a7b94e67c24","tlsh":"ae74b4497af221a20d5330a66f2b6045a736a107390cdc647dce93641f5ebbc87b7fa4"}],"package_integrity":[{"filename":"solana-web3-fork-1.0.0.tgz","hashes":{"sha1":"48fc4302bf76674656df32add73db7863f75e141","sha512_sri":"sha512-0rg7STLbtu/b2SDfDglrnWdEFVL57HrUSd/6a/f/rdXh2EeEQtUYpsZUGVtMlrkwD6592V89GXiIMQ54Xsj1Rg=="}}]}}}],"references":[{"type":"WEB","url":"https://research.jfrog.com/post/solana-fakefix"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/solana-web3-fork/v/1.0.0"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-rf7g-mf44-5m44"}],"database_specific":{"malicious-packages-origins":[{"id":"RLMA-2026-05622","import_time":"2026-07-20T13:14:51.861888568Z","modified_time":"2026-07-20T10:59:23Z","sha256":"1bc559bc0125cc1b97a9049b05819eed10a306fc96bdcf849377be3c164f5007","source":"reversing-labs","versions":["1.0.0"]},{"id":"IN-MAL-2026-013008","import_time":"2026-08-05T06:00:30.479714602Z","modified_time":"2026-08-05T05:20:41Z","sha256":"912cb41aa6b78cf62207dbf95f7d6247238483a800fa9bc6edd9b9d9f7819364","source":"amazon-inspector","versions":["1.0.0"]},{"id":"RLUA-2026-06503","import_time":"2026-09-01T11:18:25.050389107Z","modified_time":"2026-08-24T17:11:30Z","sha256":"1e247514da2aeddeb3d93f2194b2041beee3594c2b19db6f52b0bac7ee9440f6","source":"reversing-labs"}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"ReversingLabs","contact":["https://www.reversinglabs.com"],"type":"FINDER"}]}