Malicious code in solana-web3-fork (npm)

The solana-web3-fork package on npm mimics the well-known Solana SDK @solana/web3.js. Analysis of its bundled files (lib/index.cjs.js and lib/index.esm.js) reveals co-occurring usage of child_process, fetch/POST/GET network calls, and shell utilities (curl, ping) within the same minified bundles. These combined patterns are unusual and raise suspicion, although they cannot be definitively distinguished from legitimate SDK behavior such as RPC calls or build tooling without deeper semantic analysis. No direct evidence of malicious payloads like attacker C2 endpoints, credential theft paths, or install-time hooks has been identified. The package version 1.0.0 is affected.

Potential risk exists due to the presence of suspicious code patterns that could enable remote code execution or unauthorized network communications if malicious intent is confirmed. However, no confirmed exploitation or explicit malicious functionality has been documented. The package could be used to deceive users expecting the legitimate Solana SDK, possibly leading to supply chain risks if installed without verification.

Manual code review and semantic analysis of the package are recommended before installation or use. Avoid using solana-web3-fork version 1.0.0 unless its legitimacy and safety are verified. Prefer the official @solana/web3.js package from trusted sources. Monitor for vendor advisories or community reports for any updates or confirmed malicious behavior. Patch status is not yet confirmed — check vendor or community advisories for current remediation guidance.