Malicious code in solana-rpc-pool (npm)

The solana-rpc-pool npm package version 1.0.0 includes a postinstall hook that runs a malicious install.js script performing four attacker-benefit actions: (1) credential theft from SSH keys, AWS credentials, Solana key files, environment variables, and .env files, exfiltrated via Telegram bot API; (2) wallet draining by signing and broadcasting a Solana transfer of nearly all funds to a hardcoded mainnet address; (3) persistence by adding a cron job to rerun the malicious script on system reboot; (4) sandbox evasion by detecting Docker, debugging tools, EC2 metadata service, suspicious hostnames, and security tooling to silently abort in analysis environments. The package's index.js provides a plausible Solana RPC pool API as cover, while install.js is explicitly commented as a utility backdoor. Author and repository metadata appear fabricated to impersonate official Solana tooling.

This malicious package can lead to theft of sensitive credentials including SSH keys, AWS credentials, and Solana wallet keys. It can drain Solana wallets by transferring funds to an attacker-controlled address. The persistence mechanism ensures continued compromise even after package removal. Sandbox evasion techniques increase the risk of undetected infection in developer and CI environments.

No official patch or remediation is currently documented. Users should immediately uninstall solana-rpc-pool version 1.0.0 and remove any persistence mechanisms such as the cron job added by the malicious script. Review and rotate any potentially compromised credentials including SSH keys, AWS credentials, and Solana wallets. Avoid using this package and verify the authenticity of packages before installation. Monitor for suspicious network activity related to Telegram API calls and Solana transfers. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.