@merceas/anchor (npm) · Malicious Code
Affects @merceas/anchorSource GCVE Database
Malicious package : remove @merceas/anchor and rotate any secrets on hosts that installed it.
Data as of 26 Jun 2026, 22:32 UTC
Malicious package
Published to npm · OSV MAL-2026-6509
What to do
Remove @merceas/anchor from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npm@merceas/anchor | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The @merceas/anchor npm package is a typosquatting impersonation of the legitimate @coral-xyz/anchor Solana Anchor SDK. It replaces the standard cross-fetch dependency with a malicious aliased package under the same scope, causing all HTTP requests made through the SDK to be routed through attacker-controlled code. This malicious behavior is embedded in the transitive dependency @merceas/cross-fetch, not directly in the main package tarball. Versions 0.32.1 and 0.32.3 of @merceas/anchor are affected.