MAL-2026-13351

    Dashboard / Malicious Package / MAL-2026-13351

    MAL-2026-13351

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in spl-token-utils (npm)

    Details: Source: amazon-inspector (f95b625c92e85b1c0d5c10a192c70f8f82cf8d3b2ac7b66c034635b680785654) On require, index.js serializes the full process.env together with hostname, username, homedir, platform, cwd, and package metadata, base64-encodes the payload, and sends it via an HTTPS GET to api.telegram.org/bot<redacted>/sendMessage with a hardcoded chat_id (8969499041). A marker file in the OS tmpdir suppresses repeat sends. The package presents itself as a drop-in replacement for @solana/spl-token and attempts to require and re-export the real @solana/spl-token so consumers see functional behavior while the exfiltration has already fired. Bulk process.env harvest at import time captures whatever credentials the installer's Node process has in environment — cloud keys, CI/publish tokens, database URLs — none of which relate to any legitimate SPL/Solana utility function. The typosquat name (spl-token-utils vs @solana/spl-token) makes accidental installs likely.

    References: https://www.npmjs.com/package/spl-token-utils/v/1.4.2

    Affected packages

    Package

    Name: spl-token-utils

    Purl: pkg:npm/spl-token-utils

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.4.2
    MAL-2026-13351 | CVE-DB