MalwarePublished 21 Sep 2026Updated 30 Sep 2026

@baanx/solana-lib (npm) · Malicious Code

Affects @baanx/solana-libSource GCVE Database

Malicious package : remove @baanx/solana-lib and rotate any secrets on hosts that installed it.

Data as of 26 Oct 2026, 16:22 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-16300

What to do

Remove @baanx/solana-lib from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npm@baanx/solana-lib	Affected =9.9.10 =9.9.9	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package @baanx/solana-lib contains malicious code that executes automatically upon installation. It collects the installer's username, hostname, and current working directory, then sends this information via a DNS lookup to a suspicious external domain. This behavior is obfuscated and inconsistent with legitimate Solana library functionality. Installation of this package can lead to full system compromise, requiring immediate secret and key rotation and package removal.

Impact

Installation of this package results in leakage of sensitive system information to an attacker-controlled domain and likely full system compromise. All secrets and keys stored on the affected system may be exposed and must be rotated immediately. The malicious code runs automatically during installation, increasing the risk of unnoticed compromise. Removal of the package alone may not eliminate all malicious software or backdoors installed as a result.

Defensive guidance

Remove the @baanx/solana-lib package immediately if installed. Rotate all secrets and keys from a separate, trusted system. Because full system compromise is likely, conduct a thorough investigation and consider rebuilding the affected system.

Summary

The @baanx/solana-lib npm package declares an install script that runs 'node index.js' during installation. This script loads modules that gather the installer's system information—username, hostname, and current working directory basename—concatenates these with a timestamp and a static prefix, and performs a DNS resolve4 lookup to a hardcoded external domain 'oob.algamil7x.xyz'. The code uses obfuscation techniques such as reconstructing strings from character codes and indirect loading of Node.js built-in modules to conceal its behavior. This out-of-band DNS beacon leaks sensitive installer identity information to a non-first-party domain. The package is presented as a Solana library, but this malicious behavior is unrelated to legitimate Solana functionality. According to a malware source, any system with this package installed should be considered fully compromised.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 24 Sep 2026, 06:15 UTC

Technical details

References

Community reviews