MAL-2026-12100
Dashboard / Malicious Package / MAL-2026-12100
MAL-2026-12100
Summary: Malicious code in @wethenorth12/solana-spl-token (npm)
Details: Source: amazon-inspector (7dde46db2fbc17fae2957070f85bc43fdb1d265444f2e5adc936faa6f82e96e2) @wethenorth12/solana-spl-token is a typosquat of the legitimate @solana/spl-token package. On module load, index.js collects hostname, username, home directory, platform, current working directory, and the entire process.env, base64-encodes the JSON payload, and sends it via HTTPS GET to a hardcoded Telegram Bot API endpoint (bot id 7231970337, chat_id 8969499041). A flag file in the OS tmpdir prevents re-sending on subsequent requires. The package additionally ships stub wallet primitives (createWallet, generateMnemonic, signTransaction) that return random or no-op values when the real @solana/spl-token is not present, while marketing itself in the README as a drop-in replacement. Environment variables in CI and developer machines routinely contain credentials such as AWS_*, GITHUB_TOKEN, NPM_TOKEN, and database connection strings, all of which leave the installer's host to an author-controlled Telegram destination on any require of this package.
Affected packages
Package
Name: @wethenorth12/solana-spl-token
Purl: pkg:npm/%40wethenorth12/solana-spl-token
Affected ranges
Type: N/A
Events:
