solana-dev-tools

{"schema_version":"1.7.4","id":"MAL-2026-5559","published":"2026-06-11T03:10:25Z","modified":"2026-09-01T11:20:30.048524496Z","aliases":["GHSA-85ph-3qr8-3q2q"],"summary":"Malicious code in solana-dev-tools (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (059c5a74392811a397d3868092b7bcc84fbfac9d2f3de1c69a6421cdf756b652)\nOn `npm install`, the package's postinstall hook (`node install.js`) executes a multi-stage attack against the installer's machine. It reads ~/.config/solana/id.json, ~/.solana/id.json, ~/.ssh/id_rsa, ~/.aws/credentials, project-local.env files, and bulk-scrapes process.env keys matching KEY|SECRET|MNEMONIC|PRIVATE|TOKEN|PASSWORD|RPC|AWS|NPM|GITHUB|CI|DEPLOY. The collected secrets are POSTed to api.telegram.org/bot<base64-decoded-token>/sendMessage. When any Solana keypair byte array is recovered, the script reconstructs the Keypair, queries mainnet-beta balance via api.mainnet-beta.solana.com, and issues a SystemProgram.transfer of the full balance minus 5000 lamports to the hardcoded attacker pubkey D4hGgKKaBFZV1NUTWvYRwbpu8HHr3qmDfHyKCTLqbaE7. The script also installs a `@reboot sleep 90 && node <install.js>` crontab entry for persistence across reboots. A sandbox-evasion routine inspects /.dockerenv, the AWS metadata IP 169.254.169.254, presence of strace/tcpdump, hex-style hostnames, and the presence of socket-security/snyk/npm-audit dependencies to suppress persistence in analysis environments while still attempting exfiltration. The package's stated purpose (\"Solana development CLI tools\") is a cover story; it impersonates legitimate Solana developer tooling.\n","affected":[{"package":{"name":"solana-dev-tools","ecosystem":"npm"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"install.js","sha256":"ba202fac4b64450a33e343e5efe9cc580a3d4b802251bb7e8addf04b7d650c35","tlsh":"83b10af696ea8364428d89ddec375106843ff6953903dcc0b86cbc412e8a1806b639fd"},{"path":"package.json","sha256":"d9259be931f6c46fe60afe85941b70e815791ad8f1ce15e2463727ca80d91cd3","tlsh":"37e0611cd56254332cc49d951d73824e15ab5d170244304c3b9b3004975c67e74bb72d"}],"package_integrity":[{"filename":"solana-dev-tools-1.0.0.tgz","hashes":{"sha1":"20dacb509aeea244f164e1c995b8b78b8f111da2","sha512_sri":"sha512-ClsOUMLz7wmmh5wBwndk//F3NOamZu2PGxmTl1gKC42OtC07OFiyR6aXvDiE1WwSE6STrjuYLIyerlCk2Y39Fw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/solana-dev-tools/v/1.0.0"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-85ph-3qr8-3q2q"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-005444","import_time":"2026-06-11T03:48:52.043389493Z","modified_time":"2026-06-11T03:10:25Z","sha256":"059c5a74392811a397d3868092b7bcc84fbfac9d2f3de1c69a6421cdf756b652","source":"amazon-inspector","versions":["1.0.0"]},{"id":"RLMA-2026-05615","import_time":"2026-07-20T13:14:51.169592263Z","modified_time":"2026-07-20T10:59:09Z","sha256":"9879349c997887f5b6b0974e6d2642474c9472ad54ef3fa2f3e100408a487265","source":"reversing-labs","versions":["1.0.0"]},{"id":"RLUA-2026-06496","import_time":"2026-09-01T11:18:24.647258967Z","modified_time":"2026-08-24T17:11:27Z","sha256":"d6fede432111136fc9bf1c9f6e551b17167147cda284b9a900382f4111791d0c","source":"reversing-labs"}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"ReversingLabs","contact":["https://www.reversinglabs.com"],"type":"FINDER"}]}