Malicious code in @solana-labs/web3js (npm)

The '@solana-labs/web3js' npm package is a suspicious lookalike of the official '@solana/web3.js' Solana client SDK. Its minified bundles include references to child_process and network request strings, which are consistent with legitimate JSON-RPC client functionality but could also be used for malicious purposes. No explicit malicious code such as top-level network beacons or hardcoded attacker endpoints has been identified. The primary concern is the risk of developer confusion due to the similar package name and scope, which could lead to unintended installation of a potentially malicious package. Further manual analysis is required to confirm the nature of the network calls and the legitimacy of the package publisher.

If developers mistakenly install '@solana-labs/web3js' instead of the official '@solana/web3.js', there is a risk of executing untrusted code that may perform unauthorized network operations. Although no confirmed malicious behavior has been detected, the presence of child_process and network-related code in the bundle raises suspicion. The impact is primarily related to supply chain risk and potential code execution or data exfiltration if the package is malicious.

No official patch or remediation is currently available. Developers should verify the package scope and name carefully before installation to avoid confusion with the official '@solana/web3.js' package. It is recommended to only install packages from verified publishers and to conduct manual code reviews or use trusted sources for critical dependencies. Monitor vendor advisories for updates regarding this package and await further analysis results.