MAL-2026-5788

Dashboard / Malicious Package / MAL-2026-5788

MAL-2026-5788

Summary: Malicious code in @solana-labs/web3js (npm)

Details: Source: amazon-inspector (d9bcfcd3a9b7eb540a36cb0d90a75c1e0c94cb5e78e265a85539608e3503a214) Package name `@solana-labs/web3js` closely resembles the well-known `@solana/web3.js` library (different scope, missing dot in module name). The bundled `lib/index.cjs.js` and `lib/index.esm.js` are large minified blobs that include `require('child_process')`, `fetch(`, `POST`, `curl`, and `ping` strings, but the bundle is consistent in shape with a Solana web3 client SDK (RPC client, websocket subscriptions, JSON-RPC POST calls to user-configured endpoints). The keyword co-occurrence in a minified rollup bundle does not by itself confirm exfiltration: a JSON-RPC client legitimately POSTs to caller-supplied RPC URLs, and `child_process` references can come from bundled diagnostics or test utilities pulled into the rollup. No lifecycle script, top-level network beacon, or hardcoded attacker endpoint has been confirmed in the traced code. The primary concern is name/scope confusion against the official `@solana/web3.js` package, which carries real installer risk if developers select the wrong dependency. Routing to human review to (a) confirm whether the scope `@solana-labs` is an official Solana publisher or a lookalike, and (b) de-minify the relevant spans of the bundle to confirm the network calls are caller-configured RPC endpoints rather than a hardcoded C2.

References: https://www.npmjs.com/package/@solana-labs/web3js/v/1.0.8, https://www.npmjs.com/package/@solana-labs/web3js/v/1.0.7, https://www.npmjs.com/package/@solana-labs/web3js/v/1.0.6, https://www.npmjs.com/package/@solana-labs/web3js/v/1.0.10, https://www.npmjs.com/package/@solana-labs/web3js/v/1.0.5, https://www.npmjs.com/package/@solana-labs/web3js/v/1.0.0, https://research.jfrog.com/post/solana-fakefix, https://www.npmjs.com/package/@solana-labs/web3js/v/1.98.107, https://www.npmjs.com/package/@solana-labs/web3js/v/1.0.4, https://www.npmjs.com/package/@solana-labs/web3js/v/1.0.3, https://www.npmjs.com/package/@solana-labs/web3js/v/1.98.110, https://www.npmjs.com/package/@solana-labs/web3js/v/1.98.105, https://www.npmjs.com/package/@solana-labs/web3js/v/1.98.112, https://www.npmjs.com/package/@solana-labs/web3js/v/1.98.103, https://www.npmjs.com/package/@solana-labs/web3js/v/1.98.108, https://www.npmjs.com/package/@solana-labs/web3js/v/1.98.109, https://www.npmjs.com/package/@solana-labs/web3js/v/1.98.111, https://github.com/advisories/GHSA-pqhf-q5g8-6jpm