MAL-2026-5358

    Dashboard / Malicious Package / MAL-2026-5358

    MAL-2026-5358

    Published: 9 Jun 2026Last Modified: 9 Jul 2026

    Summary: Malicious code in solana-core-4 (npm)

    Details: Crypto/SSH/wallet stealer, blockchain-helper-0/web3-tools-9 campaign sibling (c960/c961). postinstall scripts/postinstall.js auto-execs, src/index.js harvests ~/.ssh/id_rsa+wallet keys/seeds+env, self-labels "CRYPTO STEALER", exfils to IDENTICAL Telegram bot 8227918239 chat 6433587894 (not rotated). Generic-crypto-name + numeric suffix + 1.0.0 pattern. Source: amazon-inspector (61592bcace57b51c5e1371d9645f1a3ab04ea4d9e148dcacca192ed98e82e36c) The package was found to contain malicious code or consuming dependency that contains malicious code Source: ossf-package-analysis (efb376d3542aadcfbbb9f689dcfcd73534f230fbe75ed465327444685097fd6d) The OpenSSF Package Analysis project identified 'solana-core-4' @ 1.0.0 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.

    References: https://app.safedep.io/community/malysis/01KTN5C8PDTMRFMHPJX8KW1TNG, https://www.npmjs.com/package/solana-core-4/v/1.0.0

    Affected packages

    Package

    Name: solana-core-4

    Purl: pkg:npm/solana-core-4

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -None

    Affected versions

    1.0.0