exodus-solana-sdk

{"modified":"2026-06-09T17:47:56Z","published":"2026-06-09T17:44:20Z","schema_version":"1.7.4","id":"MAL-2026-5442","summary":"Malicious code in exodus-solana-sdk (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (ecffe98bff5e1c4655631cf8f92b1b1ccb534e0eeaa7043fab0d5fa1fbfabc35)\nPackage name impersonates the Exodus cryptocurrency wallet brand (exodus-solana-sdk). package.json declares a postinstall hook (`node src/canary.js`) that fires automatically on `npm install`. canary.js performs a DNS lookup and HTTPS GET to a hardcoded `96e03fa6c292469a-172-245-86-254.serveousercontent.com` endpoint — a serveo.net reverse-tunnel domain that is anonymous, mutable, and operator-controlled. The hostname embeds an IPv4 address (172.245.86.254), and the response body is silently discarded (`r.resume()`), confirming the request's purpose is reconnaissance rather than data delivery to the installer. The beacon reveals the installer's egress IP, DNS resolver, and install-time event to whoever controls the tunnel. The package's own description self-identifies as a 'Security research canary — Exodus HackerOne PoC. Not a real package.', but it is published to the public npm registry where any developer who mistypes the package name will execute the beacon. Self-declared research framing does not neutralize installer-side harm: install-time outbound network to an anonymous tunnel under a brand-impersonating package name is the typosquat-reconnaissance attack shape.\n","affected":[{"package":{"ecosystem":"npm","name":"exodus-solana-sdk"},"versions":["99.0.0-canary.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"domains":["96e03fa6c292469a-172-245-86-254.serveousercontent.com"],"evidence_files":[{"path":"src/canary.js","sha256":"ef2b6f485b2532da51b9f5f82a44416947f1d965023718a03005da3a51a68b45","tlsh":"4ed022fe91c4080aa3a047ac841a60cab94bc9f8008485d2730c86d220c0aeea2ac238"},{"path":"package.json","sha256":"2a0a8913bdbc8661152e0ea8af968912046175711f0d6bd8ec9fe8a44e9f1ecd","tlsh":"ded09704886002333dc889e70ea2c08a40283c072220bc2c93633404300cf771ff3220"}],"package_integrity":[{"filename":"exodus-solana-sdk-99.0.0-canary.1.tgz","hashes":{"sha1":"0a3c41a02014c79574d497720f5949ac9dfed323","sha512_sri":"sha512-NMEn10jlHkRiXgqS9u1rkNLJaMQuyCTmtrCOuEM3JY4tbX21Gs1Mon7O8B5GZRo3H6Esix6YW6L5bSlZxAEO3g=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/exodus-solana-sdk/v/99.0.0-canary.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-005110","import_time":"2026-06-09T17:45:55.115477785Z","modified_time":"2026-06-09T17:44:21Z","sha256":"8f222f4981a374a98219a8b4fd00b46127e599c448f2f0881e558f4984c57d08","source":"amazon-inspector","versions":["99.0.0-canary.1"]},{"id":"IN-MAL-2026-005109","import_time":"2026-06-09T17:45:55.072246699Z","modified_time":"2026-06-09T17:44:20Z","sha256":"ecffe98bff5e1c4655631cf8f92b1b1ccb534e0eeaa7043fab0d5fa1fbfabc35","source":"amazon-inspector","versions":["99.0.0-canary.1"]}]}}