Malicious code in solana-web3-fixed (npm)

The 'solana-web3-fixed' package mimics a fix-branded variant of the popular '@solana/web3.js' library, a common tactic in typosquatting attacks. Static analysis detected multiple high-risk patterns in both CommonJS and ESM bundles, including invocation of 'child_process' modules combined with network requests and shell commands, which are typical indicators of credential exfiltration attempts. However, the minified nature of the code and lack of dynamic tracing prevent conclusive attribution of malicious intent. The package is flagged for human review before use in any installation pipeline.

If malicious, this package could potentially exfiltrate credentials or execute unauthorized commands on systems where it is installed, posing a risk to user security and data confidentiality. However, no confirmed exploitation or active attacks have been reported. The risk primarily arises from the package's deceptive naming and suspicious code patterns.

Users and organizations should avoid installing or trusting the 'solana-web3-fixed' package, especially version 1.0.0, without thorough manual code review. Prefer the official '@solana/web3.js' library from trusted sources. Monitor package dependencies for typosquatting variants and implement supply chain security controls. Since no official patch or fix exists, prevention by avoidance and verification is recommended.