MAL-2026-10901

    Dashboard / Malicious Package / MAL-2026-10901

    MAL-2026-10901

    Published: 20 Jul 2026Last Modified: 1 Sept 2026Aliases: 
    GHSA-8wj2-r9xj-g9p3

    Summary: Malicious code in solana-web3-lts (npm)

    Details: Source: amazon-inspector (51efd3d5cdcb8fb794a1702f586abd7018d86aad3e40286f5a43dd1127d804ed) Package name 'solana-web3-lts' resembles the widely-used '@solana/web3.js' Solana SDK, raising name-confusion concerns for installers reaching for the official client. The shipped library bundles (lib/index.cjs.js, lib/index.esm.js) contain co-occurring use of child_process, fetch/POST/GET, and shell utilities (curl, ping) within large minified files; pattern-level signals match exfiltration shapes but full semantic tracing of the bundle did not complete, so it is not confirmed whether these primitives are reachable from an install/import path or are part of legitimate SDK functionality (e.g., RPC HTTP transports, build tooling). Recommend human review of the bundle to determine whether the child_process + network combination represents a hardcoded C2 exfiltration path or benign SDK code, and to confirm the package's relationship (if any) to the official Solana web3 client.

    References: https://research.jfrog.com/post/solana-fakefix, https://www.npmjs.com/package/solana-web3-lts/v/1.0.0, https://github.com/advisories/GHSA-8wj2-r9xj-g9p3

    Affected packages

    Package

    Name: solana-web3-lts

    Purl: pkg:npm/solana-web3-lts

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0