MAL-2026-5860

Dashboard / Malicious Package / MAL-2026-5860

MAL-2026-5860

Summary: Malicious code in solana-js-client (npm)

Details: Source: amazon-inspector (855cf386497f33e21db48ae8b87c769fd777f52b585f3d8d5f276fd4c9d42628) Package masquerades as a 'Drop-in replacement for @solana/web3.js' and lists its author as 'Solana Labs Maintainers <[email protected]>' to impersonate the legitimate Solana Labs publisher. The published bundles lib/index.cjs.js and lib/index.esm.js contain an injected payload at the tail of the file with no counterpart in src/. The payload requires child_process, shells out via curl/ping, and references a hardcoded plain-HTTP endpoint http://104.239.66.223:8899 (port 8899 is the Solana JSON-RPC port) along with Telegram Bot API sendMessage URLs carrying a chat_id controlled by the attacker. Because the package's primary API is the Connection class, any consumer wallet or dApp that imports this drop-in replacement can have its outbound RPC traffic, signed transactions, or seed material silently rerouted to the attacker-owned RPC and exfiltrated to the attacker's Telegram bot. Indicators: rogue RPC at 104.239.66.223:8899; exfiltration channel via api.telegram.org/bot<redacted>/sendMessage.

References: https://www.npmjs.com/package/solana-js-client/v/1.0.0, https://research.jfrog.com/post/solana-fakefix, https://github.com/advisories/GHSA-w6xx-m24v-5674