Malicious code in solana-rpc-client (npm)

The solana-rpc-client package version 1.0.0 bundles minified code that co-locates child process invocation, HTTP network calls, and references to curl and ping commands. While such behavior can be consistent with legitimate RPC client operations, the presence of these elements also raises suspicion of potential malicious code designed for data exfiltration. The available evidence does not clarify if network calls occur at install or import time, nor does it confirm the destinations of these calls. No package lifecycle scripts have been found to trigger malicious activity. The package requires manual code de-minification and analysis to verify if network destinations are legitimate Solana RPC endpoints or malicious servers.

Potential impact includes unauthorized execution of child processes and network communication that could lead to data exfiltration or other malicious activities if the network destinations are attacker-controlled. However, no confirmed exploitation or active malicious behavior has been reported. The threat remains unconfirmed pending further analysis.

Patch status is not yet confirmed — check the vendor advisory or official sources for current remediation guidance. Until confirmation, avoid using solana-rpc-client version 1.0.0 from untrusted sources. Conduct manual code review or use trusted package sources. No official fix or patch has been documented at this time.