solana-pda-helper

{"modified":"2026-05-26T05:55:04Z","published":"2026-05-20T00:09:21Z","schema_version":"1.7.4","id":"MAL-2026-4247","aliases":["GHSA-jrx8-mvj8-9gq2"],"summary":"Malicious code in solana-pda-helper (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (932b19a77a3ac634909a0f284df48d9b2a8b28f9c5370bd50306d7ba5a1335e9)\nOn npm install, package.json's postinstall hook runs `node -e` to issue an https.get against `rqnyz-2605-7280-7--2000-c51.run.pinggy-free.link/npm/-/binary/telemetry` — a Pinggy free-tier reverse-tunnel subdomain, which is the ephemeral attacker-callback host class, not legitimate telemetry infrastructure. The request is wrapped in try/catch to silently swallow errors, and even a failed request leaks installer IP, hostname resolution, and install timing to attacker infrastructure; the same hook is a standard staging point for follow-on payload delivery. The package compounds this with namespace-abuse signals: it advertises itself as 'Automatic PDA derivation for Anchor programs' but `index.js` is a 139-byte stub that only console.logs and shells out to `solana --version`, implementing none of the advertised functionality; the repository field points at `github.com/solana/solana-pda-helper`, impersonating the Solana org, which does not own this package; and keywords include 'ethereum' for a Solana-branded package. The combination of org-impersonation, hollow implementation, and install-time beacon to an ephemeral tunnel is a deliberate supply-chain attack lure rather than a misconfigured package.\n\n## Source: ghsa-malware (6344bcb520f7710af49688f775268fc50814d9d4a0d479550505f8b3e17a25de)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"ecosystem":"npm","name":"solana-pda-helper"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["1.0.46"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"fa24e226d2c46efa3697b45579583acc1619f0eda338508a6d0295ab15ebb4a6","tlsh":"cdf0ac64e6b85c7309d41a6b4d696081f4228c0b5a40bc0c7b87a11ec7afb7715fda6e"},{"path":"index.js","sha256":"687411faa87786d771987597341bdcf738d5d71984d0ffb698db9c6e741be60e","tlsh":"77c02b7007d489f2301000067c01d4923ad38d36b100e108082c5c8b0784788213e47d"}],"package_integrity":[{"filename":"solana-pda-helper-1.0.46.tgz","hashes":{"sha1":"949b34ed2461a869fb10581ba4660e4b3e734058","sha512_sri":"sha512-VacxTDOF0kgyXnpqrrP2HXVpONQOL0tYDdZjXT07/reE3ReMImvUcP9MPBQPAlw0h6MSCFPKWjLF1fpryALG4g=="}}]}}}],"references":[{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-jrx8-mvj8-9gq2"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/solana-pda-helper/v/1.0.46"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["actran@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"source":"ghsa-malware","sha256":"6344bcb520f7710af49688f775268fc50814d9d4a0d479550505f8b3e17a25de","import_time":"2026-05-22T03:24:54.640620591Z","id":"GHSA-jrx8-mvj8-9gq2","modified_time":"2026-05-22T02:43:00Z","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]},{"source":"amazon-inspector","sha256":"932b19a77a3ac634909a0f284df48d9b2a8b28f9c5370bd50306d7ba5a1335e9","import_time":"2026-05-26T05:50:24.250846202Z","id":"IN-MAL-2026-003312","modified_time":"2026-05-20T00:09:21Z","versions":["1.0.46"]}]}}