soltinel-pro

{"modified":"2026-09-09T18:24:43Z","published":"2026-09-09T17:45:22Z","schema_version":"1.7.4","id":"MAL-2026-16096","summary":"Malicious code in soltinel-pro (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (01f489c47a35cb393c976988c8f12eb9b47cddac13ae4112b019adad4eefb646)\npostinstall.cjs is declared as the package.json postinstall script and runs automatically on npm install. The script walks parent directories for.env files (filtering values by KEY/SECRET/PRIVATE/TOKEN), reads the Solana CLI keypair, enumerates ~/.config for env/key/wallet/credentials files, reads ~/.ssh private keys (id_rsa, id_ed25519, *_rsa, *_ed25519), ~/.git-credentials, and ~/.netrc, then POSTs the file contents via https.request to a hardcoded webhook.site collector. The file self-identifies in a header comment as a 'Master Harvester — injectable into any npm package via postinstall'. The package advertises itself as a Solana trading bot; the shipped install hook is an unrelated secrets exfiltrator.\n","affected":[{"package":{"ecosystem":"npm","name":"soltinel-pro"},"versions":["0.2.1","0.2.2","0.2.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"postinstall.cjs","sha256":"2d80d2ec442e9374a3fb07e55b10d6c77d7f49bc423206cd26106493abfd2509","tlsh":"216133db09dd06109b97e3d9c50b6415ad62d25333027dd87deca6e8ef830b48582bbc"},{"path":"package.json","sha256":"897ffa353a6a0a1013ae3cad6138369fcc381bf77a0d8d0e7ba15d83365a337b","tlsh":"0e31e012caaa8da316c45ad66c6a0043b935d467cd10fc1d33e2425c8f8d0af21be67d"}],"package_integrity":[{"filename":"soltinel-pro-0.2.1.tgz","hashes":{"sha1":"baeebf3de418d946eef51357cfbd2a0fe697905b","sha512_sri":"sha512-R+fAZpgWhPrZMxL5YIateAdnTCRJ/m+pz8HHjljDWGtNbfUTQOEB8gOikcNvetU1n00rzrgkfTtwPe9qAzehSQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/soltinel-pro/v/0.2.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/soltinel-pro/v/0.2.2"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/soltinel-pro/v/0.2.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-019863","import_time":"2026-09-09T18:22:52.926567187Z","modified_time":"2026-09-09T17:45:48Z","sha256":"01f489c47a35cb393c976988c8f12eb9b47cddac13ae4112b019adad4eefb646","source":"amazon-inspector","versions":["0.2.1"]},{"id":"IN-MAL-2026-019864","import_time":"2026-09-09T18:22:53.047955382Z","modified_time":"2026-09-09T17:45:57Z","sha256":"03af07948d5dfc588ae1b4148f42c59cc5bef793dad8681e17076eb56fe3d64f","source":"amazon-inspector","versions":["0.2.2"]},{"id":"IN-MAL-2026-019860","import_time":"2026-09-09T18:22:52.566264437Z","modified_time":"2026-09-09T17:45:22Z","sha256":"2d9f825e5d41ac9069f31c3697346425e28b02e41f9cbc08d4f55444ddfa5224","source":"amazon-inspector","versions":["0.2.0"]}]}}