MalwarePublished 9 Jun 2026Updated 9 Jul 2026

solana-core-4 (npm) · Malicious Code

Affects solana-core-4Source GCVE Database

Malicious package : remove solana-core-4 and rotate any secrets on hosts that installed it.

Data as of 11 Jul 2026, 09:43 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-5358

What to do

Remove solana-core-4 from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmsolana-core-4	Affected =1.0.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

Crypto/SSH/wallet stealer, blockchain-helper-0/web3-tools-9 campaign sibling (c960/c961). postinstall scripts/postinstall.js auto-execs, src/index.js harvests ~/.ssh/id_rsa+wallet keys/seeds+env, self-labels "CRYPTO STEALER", exfils to IDENTICAL Telegram bot 8227918239 chat 6433587894 (not rotated). Generic-crypto-name + numeric suffix + 1.0.0 pattern. --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (61592bcace57b51c5e1371d9645f1a3ab04ea4d9e148dcacca192ed98e82e36c) The package was found to contain malicious code or consuming dependency that contains malicious code ## Source: ossf-package-analysis (efb376d3542aadcfbbb9f689dcfcd73534f230fbe75ed465327444685097fd6d) The OpenSSF Package Analysis project identified 'solana-core-4' @ 1.0.0 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.

Impact

Users who install 'solana-core-4' version 1.0.0 risk having their SSH private keys, cryptocurrency wallet keys, seeds, and environment variables stolen. This can lead to unauthorized access to systems and cryptocurrency wallets, resulting in potential financial loss and system compromise. The exfiltration to a Telegram bot suggests data is accessible to attackers in real time.

Defensive guidance

Users should avoid installing 'solana-core-4' version 1.0.0 and remove it if already installed. Verify dependencies to ensure no indirect inclusion of this package. Monitor for suspicious postinstall scripts in npm packages. Since this is a malicious package rather than a vulnerability in legitimate software, remediation involves removal and avoidance rather than patching.

Summary

The 'solana-core-4' npm package at version 1.0.0 is identified as malicious due to embedded code that automatically executes upon installation. This code harvests sensitive credentials including SSH private keys (~/.ssh/id_rsa), cryptocurrency wallet keys and seeds, and environment variables. The stolen data is exfiltrated to a fixed Telegram bot chat, indicating targeted data theft. The package is part of a campaign involving similarly named malicious packages and uses a naming pattern with generic crypto-related names plus numeric suffixes. The OpenSSF Package Analysis and Amazon Inspector flagged this package for malicious behavior and communication with known malicious domains.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 10 Jul 2026, 09:37 UTC

Technical details

References

Community reviews