MalwarePublished 14 Jul 2026

solana-key-utils (npm) · Malicious Code

Affects solana-key-utilsSource GCVE Database

Malicious package : remove solana-key-utils and rotate any secrets on hosts that installed it.

Data as of 15 Jul 2026, 12:43 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-10591

What to do

Remove solana-key-utils from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmsolana-key-utils	Affected 1.0.0 – 1.0.3 4 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The solana-key-utils npm package versions 1.0.0 through 1.0.3 contain malicious code that, upon being required, waits 37 seconds before decoding and writing a hidden JavaScript payload to the user's cache directory. This payload is then executed detached from the original process and scheduled to run persistently every 12 hours via platform-specific mechanisms on Linux, Windows, and macOS. The package name and test fixture disguise the malicious payload, enabling persistent unauthorized code execution on affected systems.

Impact

This malicious package enables persistent remote code execution on the affected system by installing scheduled tasks that run a hidden JavaScript payload every 12 hours. This can lead to unauthorized control over the host, potential data compromise, and further system exploitation. The persistence mechanisms span all major desktop platforms, increasing the attack surface and difficulty of detection and removal.

Defensive guidance

Users should immediately uninstall the solana-key-utils package versions 1.0.0 through 1.0.3 and remove any scheduled tasks or persistence mechanisms created by the package (crontab entries, Windows scheduled tasks named 'WinNodeSync', and macOS LaunchAgents at ~/Library/LaunchAgents/com.apple.syncd.plist). Monitor for and delete the dropped payload file at ~/.cache-db/.node-sync/syncd.js. Check vendor advisories or trusted sources for updates or official fixes. Avoid using this package until a safe version is released.

Summary

The solana-key-utils package (versions 1.0.0, 1.0.1, 1.0.2, and 1.0.3) contains embedded malicious code that activates on require(). It delays execution for 37 seconds, reads a base64-encoded JavaScript payload disguised as a test fixture, decodes it, writes it to ~/.cache-db/.node-sync/syncd.js with restricted permissions, and launches it as a detached process. The payload establishes persistence by installing scheduled tasks: a crontab entry on Linux, a Windows scheduled task named 'WinNodeSync', and a macOS LaunchAgent configured to run every 12 hours. This mechanism allows the attacker persistent code execution independent of the original package usage, effectively compromising the host.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 15 Jul 2026, 12:43 UTC

Technical details

References

Community reviews