web3-terminal

{"modified":"2026-07-22T20:40:05Z","published":"2026-07-22T20:40:05Z","schema_version":"1.7.4","id":"MAL-2026-11007","summary":"Malicious code in web3-terminal (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (bff469765665422f3b9a6dd9978d99ddab9f853b02109f154c97b634977cf223)\nOn npm install, package.json scripts.postinstall runs test.js, which invokes routines in index.js that (1) walk the current working directory for id.json (Solana keypair), config.toml, and.env/env files and POST each to http://170.205.31.203:3000/api/v1; (2) fetch scan and block patterns from http://170.205.31.203:3001/api/scan-patterns and /api/block-patterns and recursively scan the user's home directory (or all drives on Windows), multi-part uploading matched files to 170.205.31.203:3001; and (3) on Linux, fetch an attacker-controlled SSH public key from http://170.205.31.203:3001/api/ssh-key, append it to ~/.ssh/authorized_keys, then run `sudo ufw enable` and `sudo ufw allow 22/tcp` to open inbound SSH. Package metadata (empty description, empty author) and a name resembling legitimate Web3 tooling are consistent with a low-attribution package targeting Solana/Web3 developers.\n","affected":[{"package":{"ecosystem":"npm","name":"web3-terminal"},"versions":["2.1.6"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"d986a2e0a9eb3fc3781e166ff6b700e0d38249a6c9649982243c3754671f42d9","tlsh":"ef02934ca6fb2a2183b371ac468f1415b59ac0033949cd81b2cc97546f8f93d65f6ede"},{"path":"package.json","sha256":"a10dbd470034fa934dca698210bc490bb3cc87c944bb49fa5e0e884e0db1c7a2","tlsh":"96f06d27ce589e6358f135a8287d0627f691932f4104880f35bd675c4fbb5774485f1e"}],"package_integrity":[{"filename":"web3-terminal-2.1.6.tgz","hashes":{"sha1":"1ea549deb2cbec1a82e01a582bfe277dbcd2b4d9","sha512_sri":"sha512-SRTqTA/p0Xk076eDVzzMGO+kK2YSJsVpAMf1/LnESaUXdaC7uuxPEEb9X29eILrOHoGWPn/vNH52m6AmC281qA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/web3-terminal/v/2.1.6"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-010854","import_time":"2026-07-22T20:59:16.949616004Z","modified_time":"2026-07-22T20:40:05Z","sha256":"bff469765665422f3b9a6dd9978d99ddab9f853b02109f154c97b634977cf223","source":"amazon-inspector","versions":["2.1.6"]}]}}