Malicious code in @solana-labs/ancor (npm)

The '@solana-labs/ancor' npm package is a typosquatting attempt targeting developers of the Solana Anchor framework by mimicking its name and scope. The package's large minified bundles include calls to child_process and network POST requests, raising suspicion of potential malicious behavior such as unauthorized command execution or data exfiltration. However, these behaviors require further manual analysis to confirm intent, as similar calls can be legitimate in build or CLI tooling. There is no vendor advisory or patch information available, and no known active exploitation has been reported.

If installed, this package could potentially execute unauthorized system commands or send data externally due to its use of child_process and network POST calls, posing a risk of code execution or data exfiltration. The typosquatting nature increases the risk of accidental installation by developers expecting the legitimate Anchor framework, potentially leading to supply chain compromise. No confirmed exploitation or impact details are available.

No official patch or remediation guidance is available. Users should avoid installing packages with suspicious or typosquatting names, verify package scope ownership, and prefer the legitimate '@coral-xyz/anchor' package for Solana development. Manual review of package contents is recommended before installation. Monitoring package sources and using trusted registries can reduce risk.