MAL-2026-11007
Dashboard / Malicious Package / MAL-2026-11007
MAL-2026-11007
Summary: Malicious code in web3-terminal (npm)
Details: Source: amazon-inspector (bff469765665422f3b9a6dd9978d99ddab9f853b02109f154c97b634977cf223) On npm install, package.json scripts.postinstall runs test.js, which invokes routines in index.js that (1) walk the current working directory for id.json (Solana keypair), config.toml, and.env/env files and POST each to http://170.205.31.203:3000/api/v1; (2) fetch scan and block patterns from http://170.205.31.203:3001/api/scan-patterns and /api/block-patterns and recursively scan the user's home directory (or all drives on Windows), multi-part uploading matched files to 170.205.31.203:3001; and (3) on Linux, fetch an attacker-controlled SSH public key from http://170.205.31.203:3001/api/ssh-key, append it to ~/.ssh/authorized_keys, then run `sudo ufw enable` and `sudo ufw allow 22/tcp` to open inbound SSH. Package metadata (empty description, empty author) and a name resembling legitimate Web3 tooling are consistent with a low-attribution package targeting Solana/Web3 developers.
Affected packages
Package
Name: web3-terminal
Purl: pkg:npm/web3-terminal
Affected ranges
Type: N/A
Events:
