MAL-2026-10898

Dashboard / Malicious Package / MAL-2026-10898

MAL-2026-10898

Summary: Malicious code in solana-rpc-client (npm)

Details: Source: amazon-inspector (e57e3e79e60f9b8ec7f7c9b5199ecab2efaf72566eaed0f358a3b80adad5558d) The package's bundled entry points (lib/index.cjs.js and lib/index.esm.js) co-locate require('child_process'), fetch/POST/GET calls, and references to curl/ping within minified output. The package name suggests a Solana RPC client, which would legitimately make HTTP/RPC calls; keyword co-occurrence in a minified bundle is consistent with both that legitimate shape and an exfiltration shape, and the available evidence does not show the destination URLs, whether any code path runs at install/import time, or whether process.env or credential paths feed any of the network calls. No package.json lifecycle hook content has been confirmed. Routing to human review so a reviewer can de-minify the relevant spans (around lines 5016/5046, 11212/11317) and confirm whether the network destinations are documented Solana RPC endpoints (allow) or attacker-controlled hosts (escalate to block).

References: https://research.jfrog.com/post/solana-fakefix, https://www.npmjs.com/package/solana-rpc-client/v/1.0.0, https://github.com/advisories/GHSA-p7xx-6w55-gfrg