Malicious code in solana-js-client (npm)

The solana-js-client package (version 1.0.0) masquerades as a legitimate Solana Labs library but contains injected malicious code in its published bundles lib/index.cjs.js and lib/index.esm.js. The payload, absent from source files, uses Node.js child_process to execute shell commands like curl and ping, communicating with a hardcoded HTTP endpoint at 104.239.66.223:8899 (the Solana JSON-RPC port). It also sends exfiltrated data to an attacker-controlled Telegram bot via the Telegram Bot API. The primary API, the Connection class, enables interception and rerouting of outbound RPC traffic, signed transactions, and seed material, leading to data theft.

Any wallet or decentralized application that imports this malicious solana-js-client package risks having its RPC traffic and sensitive cryptographic material silently intercepted and exfiltrated to an attacker. This compromises the confidentiality and integrity of blockchain transactions and wallet secrets, potentially leading to theft of funds or unauthorized transaction signing.

No official patch or remediation is currently available. Users should avoid using the solana-js-client package version 1.0.0 and instead rely on the legitimate @solana/web3.js package from verified sources. Verify package authenticity by checking publisher information and package integrity before installation. Monitor for updates from the official Solana Labs or trusted security advisories for any forthcoming fixes or warnings.