Malicious code in solana-mev-bot (npm)

The solana-mev-bot package (version 1.0.0) includes a malicious script (bot.js) that performs a hardcoded HTTPS GET request to the Telegram bot sendMessage API endpoint. This request transmits host fingerprint data collected via os.hostname(), os.userInfo(), and process.platform. The script also imports child_process and accesses the filesystem using fs.existsSync and fs.readFileSync, likely to collect credential or wallet material from disk. The exfiltration channel is an attacker-operated Telegram bot. The package name is designed to impersonate a legitimate Solana MEV trading utility to lure crypto users into executing the malicious code.

Users who install and run solana-mev-bot version 1.0.0 risk having their system identity information and potentially sensitive credential or wallet data exfiltrated to an attacker-controlled Telegram bot. This can lead to compromise of user accounts, wallets, or other sensitive assets associated with the host system.

No official patch or remediation is currently available for solana-mev-bot version 1.0.0. Users should avoid installing or running this package. Remove any installations of solana-mev-bot version 1.0.0 from systems and audit for potential compromise. Monitor for suspicious network traffic to Telegram endpoints. Check vendor or repository advisories for updates or removal notices.