Malicious code in @solana-labs/web3.js (npm)

The malicious '@solana-labs/web3.js' package impersonates the legitimate '@solana/web3.js' package and re-exports it to avoid suspicion. Its postinstall script (install.js) performs environment checks to evade sandbox and analysis tools. If no analysis is detected, it enumerates and steals sensitive secrets including SSH private keys, AWS credentials, Solana and Ethereum private keys, and various environment tokens. The stolen data is tagged by type and exfiltrated via a Telegram bot using obfuscated credentials. The script then enters a command-and-control loop, accepting commands to retrieve keys, environment variables, execute shell commands, and more, effectively providing a full remote shell. Persistence is achieved by adding a cron job that runs the malicious script on reboot. A hardcoded Solana wallet address is included for direct theft of funds.

This malicious package compromises the security of any system where it is installed by stealing critical credentials and private keys, including SSH keys, AWS credentials, and cryptocurrency wallets. It enables attackers to exfiltrate sensitive data and gain full remote command execution on the victim system, allowing further compromise and potential financial theft via the hardcoded Solana wallet address. The presence of a persistent backdoor increases the risk of long-term unauthorized access.

No official patch or remediation is currently documented. Users should immediately cease using the '@solana-labs/web3.js' package and verify that only the legitimate '@solana/web3.js' package is installed from trusted sources. Remove any installations of the malicious package and inspect systems for persistence mechanisms such as unauthorized cron jobs. Rotate any potentially compromised credentials and keys. Monitor for suspicious network activity related to Telegram API endpoints. Patch status is not yet confirmed — check vendor advisories or trusted security sources for updates.