Malicious code in @solana-labs/spl-toke (npm)

The package '@solana-labs/spl-toke' on npm appears to be a malicious typosquat of the official '@solana/spl-token' package. Analysis detected suspicious network-related code patterns in its bundled JavaScript files, including fetch calls and HTTP methods that could be used for command-and-control or data exfiltration. However, the exact behavior and destination of these network calls were not confirmed in the analysis. The package name mimics the official Solana Labs scope but is missing the trailing 'n', suggesting an attempt to deceive users into installing it. Multiple specific versions are affected, but no vendor advisory or patch information is available.

If installed, this package could potentially perform unauthorized network communications, possibly leading to data exfiltration or remote control. The exact impact is unconfirmed due to incomplete analysis of the minified code. The typosquatting nature increases the risk of accidental installation by developers expecting the legitimate package, potentially compromising projects relying on it.

Users and developers should avoid installing the '@solana-labs/spl-toke' package and verify package names carefully before installation to prevent typosquatting attacks. Since no official patch or vendor advisory is available, the best mitigation is to rely solely on the legitimate '@solana/spl-token' package from the official source. Conduct manual code review if this package is found in any dependency tree and remove it immediately.