MAL-2026-13629

    Dashboard / Malicious Package / MAL-2026-13629

    MAL-2026-13629

    Published: 8 Aug 2026Last Modified: 8 Aug 2026

    Summary: Malicious code in @coralxyz/anchor (npm)

    Details: Source: amazon-inspector (1475ce579e5b1ce9d7597187d091b29b70cbe1a563ed70946517673c29683763) Package @coralxyz/anchor impersonates the legitimate Solana Anchor framework package @coral-xyz/anchor (hyphen removed). The npm postinstall hook, implemented in scripts/postinstall.js, hides all string literals behind a hex-escaped string-array decoder (_0x5a2f / _0xf). On Windows (win32), the decoded logic downloads a zip archive from the anonymous file host https://files.catbox.moe/9bppy2.zip, extracts it via PowerShell Expand-Archive to a temporary directory, walks the extracted tree, and spawns any.exe file it finds detached with windowsHide. index.js is a minimal stub; the package's advertised Anchor framework functionality is not present, and the postinstall dropper is the sole meaningful behavior. The delivery vector is name confusion with the widely used @coral-xyz/anchor package.

    References: https://www.npmjs.com/package/@coralxyz/anchor/v/0.30.2

    Affected packages

    Package

    Name: @coralxyz/anchor

    Purl: pkg:npm/%40coralxyz/anchor

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    0.30.2
    MAL-2026-13629 | CVE-DB