Malicious code in solana-web3-fixed (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2d36c0e75143828e4a93135d0c54fb34dd6e75588a493ade663a1fa4b231230c Package name 'solana-web3-fixed' resembles a fix-branded variant of the legitimate '@solana/web3.js' library, a pattern frequently used in...

Malicious code in solana-rpc-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e57e3e79e60f9b8ec7f7c9b5199ecab2efaf72566eaed0f358a3b80adad5558d The package's bundled entry points lib/index.cjs.js and lib/index.esm.js co-locate require'childprocess', fetch/POST/GET calls, and references to...

MAL-2026-10898 Malicious code in solana-rpc-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e57e3e79e60f9b8ec7f7c9b5199ecab2efaf72566eaed0f358a3b80adad5558d The package's bundled entry points lib/index.cjs.js and lib/index.esm.js co-locate require'childprocess', fetch/POST/GET calls, and references to...

Malicious code in @vite-js/vui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 89dd59b0cc2b2931e47b1822fa705eba41767d28ae89bce2e277254377dd9a0a Package publishes under @vite-js/vui while impersonating the official vite package: package.json sets author "Evan You", description "Native-ESM...

MAL-2026-10619 Malicious code in @vite-js/vui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 89dd59b0cc2b2931e47b1822fa705eba41767d28ae89bce2e277254377dd9a0a Package publishes under @vite-js/vui while impersonating the official vite package: package.json sets author "Evan You", description "Native-ESM...

Malicious code in solana-key-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 68b4680547530fce361014fe8c228734a8ec33bc8c834f46285e371e8f6b9f92 On require, index.js waits 37 seconds, reads test/fixtures/keypairs.dat a 53KB base64 blob disguised as a test fixture, no test harness references it...

MAL-2026-10591 Malicious code in solana-key-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 68b4680547530fce361014fe8c228734a8ec33bc8c834f46285e371e8f6b9f92 On require, index.js waits 37 seconds, reads test/fixtures/keypairs.dat a 53KB base64 blob disguised as a test fixture, no test harness references it...

Malicious code in @wagni_bot/solana-sdk (npm)

The npm package @wagnibot/solana-sdk is a supply-chain credential stealer disguised as a Solana SDK. It is one member of a coordinated campaign of 25 crypto/web3 typosquat packages published under the single npm scope @wagnibot on 2026-07-09. Each package declares a postinstall lifecycle hook...

Malicious code in @wagni_bot/jupiter-sdk (npm)

The npm package @wagnibot/jupiter-sdk is a supply-chain credential stealer disguised as a Jupiter Solana DEX aggregator SDK. It is one member of a coordinated campaign of 25 crypto/web3 typosquat packages published under the single npm scope @wagnibot on 2026-07-09. Each package declares a...

MAL-2026-10027 Malicious code in @wagni_bot/jupiter-sdk (npm)

The npm package @wagnibot/jupiter-sdk is a supply-chain credential stealer disguised as a Jupiter Solana DEX aggregator SDK. It is one member of a coordinated campaign of 25 crypto/web3 typosquat packages published under the single npm scope @wagnibot on 2026-07-09. Each package declares a...

Malicious code in @wagni_bot/orca-sdk (npm)

The npm package @wagnibot/orca-sdk is a supply-chain credential stealer disguised as a Orca Solana DEX SDK. It is one member of a coordinated campaign of 25 crypto/web3 typosquat packages published under the single npm scope @wagnibot on 2026-07-09. Each package declares a postinstall lifecycle...

MAL-2026-10035 Malicious code in @wagni_bot/solana-sdk (npm)

The npm package @wagnibot/solana-sdk is a supply-chain credential stealer disguised as a Solana SDK. It is one member of a coordinated campaign of 25 crypto/web3 typosquat packages published under the single npm scope @wagnibot on 2026-07-09. Each package declares a postinstall lifecycle hook...

Malicious code in solana-address-codec (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e1008cff7bb82464ce9ade3ae5c353e929b7367800b404a038baa8a026c69ae The package name resembles utilities in the Solana ecosystem e.g., @solana/addresses and address codec helpers, which is a common target for typosqua...

MAL-2026-6924 Malicious code in solana-address-codec (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e1008cff7bb82464ce9ade3ae5c353e929b7367800b404a038baa8a026c69ae The package name resembles utilities in the Solana ecosystem e.g., @solana/addresses and address codec helpers, which is a common target for typosqua...

MAL-2026-6522 Malicious code in @epsteinlovekids483/crossmint-wallets-sdk-pentest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e43e5a418541bb3e485010eba536ecc9f1483dba866af53ff4a760684409213 Package's main entry dist/index.cjs unconditionally requires dist/shai-hulud.js at module load. On require, the code harvests installer secrets —...

MAL-2026-6317 Malicious code in ts-bn-lint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e591f0b407bc22e3abe20da9207df2d2922f75d98ab97aaa62557ca88b8fc349 [email protected] is a credential harvester disguised as a TypeScript/lint utility. index.js defines decodeStr which base64-decodes all operationally...

Malicious code in solana-js-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 855cf386497f33e21db48ae8b87c769fd777f52b585f3d8d5f276fd4c9d42628 Package masquerades as a 'Drop-in replacement for @solana/web3.js' and lists its author as 'Solana Labs Maintainers ' to impersonate the legitimate...

Malicious code in solana-mev-bot (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e65516d3e042858742ebfee878ff2de6361994ce0155dcbf53c8e0f24cd5fafb bot.js performs a hardcoded HTTPS GET to api.telegram.org's bot sendMessage endpoint, transmitting host fingerprint data collected via os.hostname,...

MAL-2026-5861 Malicious code in solana-mev-bot (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e65516d3e042858742ebfee878ff2de6361994ce0155dcbf53c8e0f24cd5fafb bot.js performs a hardcoded HTTPS GET to api.telegram.org's bot sendMessage endpoint, transmitting host fingerprint data collected via os.hostname,...

Malicious code in @solana-labs/ancor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3265b293c8d6ebf4e866644687ab8bb9f03345c704acf7c885574886ad396b5b Package is published as @solana-labs/ancor — a name one character off from anchor, the well-known Solana smart-contract framework published as...