solana-web3-v1

{"schema_version":"1.7.4","id":"MAL-2026-10904","published":"2026-07-20T10:59:25Z","modified":"2026-09-01T11:20:30.063038430Z","aliases":["GHSA-x736-hhp7-jrh7"],"summary":"Malicious code in solana-web3-v1 (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (073f4c1e75630bbf1c535a334f4d7f233a73439240bc22e69bac0e926c8c58a0)\nPackage name closely mirrors the widely-used @solana/web3.js Solana SDK while being published under an unrelated, unscoped name. The bundled lib/index.cjs.js and lib/index.esm.js contain co-occurring patterns of require('child_process'), fetch/POST/GET calls, and shell utilities (curl, ping) within the same minified bundle. Without traced execution, it cannot be confirmed from these matches alone whether the network calls are user-facing RPC client functionality (consistent with a Solana SDK) or a hardcoded exfiltration channel, nor whether the child_process/curl/ping usage is dead/library code or reachable on import. Given the strong name-confusion against a high-traffic SDK target, the combination of HTTP + child_process + shell-tool keywords inside a single bundle, and the lack of clean traced evidence, this should not be auto-allowed; a human should verify the destinations, the reachability of the child_process paths, and whether the package is a legitimate fork/mirror or a confusion-attack lure.\n","affected":[{"package":{"name":"solana-web3-v1","ecosystem":"npm","purl":"pkg:npm/solana-web3-v1"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"lib/index.cjs.js","sha256":"f5d62c50dac9bc82c50b7b5a3b230009127f1f4b04d766db109fcb7a80b86262","tlsh":"1c74a2097af260a2499330a61f2b6485a736d007350cd8757dce93742f5ebbc86b7fa4"},{"path":"lib/index.esm.js","sha256":"84138890f476d20b59bb586f2f24856c61ba20d389984718c1b33a7b94e67c24","tlsh":"ae74b4497af221a20d5330a66f2b6045a736a107390cdc647dce93641f5ebbc87b7fa4"}],"package_integrity":[{"filename":"solana-web3-v1-1.0.0.tgz","hashes":{"sha1":"37ba55c1f66a3c8e87e4715d1de229cc8045d9d7","sha512_sri":"sha512-UqGdfoU5+7DNl3v2k5Xgr9Ct6AM0iLes0A/VIGQgCAJbIHZITP0iyBZKgyd/mBW8aeN1Zp3QdypgUplDeTejzA=="}}]}}}],"references":[{"type":"WEB","url":"https://research.jfrog.com/post/solana-fakefix"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/solana-web3-v1/v/1.0.0"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-x736-hhp7-jrh7"}],"database_specific":{"malicious-packages-origins":[{"id":"RLMA-2026-05626","import_time":"2026-07-20T13:14:52.208607023Z","modified_time":"2026-07-20T10:59:25Z","sha256":"6e70afc2cb0aa128d81d9347accbde8cefd415af05727bfd27745495f00d96ad","source":"reversing-labs","versions":["1.0.0"]},{"id":"IN-MAL-2026-013006","import_time":"2026-08-05T06:00:30.233848483Z","modified_time":"2026-08-05T05:20:24Z","sha256":"073f4c1e75630bbf1c535a334f4d7f233a73439240bc22e69bac0e926c8c58a0","source":"amazon-inspector","versions":["1.0.0"]},{"id":"RLUA-2026-06507","import_time":"2026-09-01T11:18:25.291641822Z","modified_time":"2026-08-24T17:11:42Z","sha256":"3ce97443aefb64bf8fd37d39138faac89f354220df72d690e0a6ccb91adb1044","source":"reversing-labs"}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"ReversingLabs","contact":["https://www.reversinglabs.com"],"type":"FINDER"}]}