Malicious code in solana-web3-lts (npm)

The 'solana-web3-lts' npm package (version 1.0.0) is flagged for suspicious behavior because its bundled JavaScript files include child_process execution, HTTP fetch requests, and shell commands like curl and ping. These combined patterns are indicative of potential command-and-control (C2) exfiltration mechanisms. The package name is similar to the official Solana web3 SDK, raising concerns about name confusion and possible supply chain risk. Full semantic analysis to confirm malicious intent was incomplete, and it remains unclear if these features are accessible via normal usage or are benign. The package is not a cloud service and no official patch or vendor advisory is available.

If the suspicious code is reachable and malicious, it could enable attackers to execute arbitrary commands and exfiltrate data from systems that install this package, posing a supply chain risk. The similarity in naming to the official Solana SDK increases the likelihood of accidental installation by developers, potentially leading to compromise of development environments or downstream applications. No active exploitation has been reported to date.

Due to the lack of a vendor advisory or official patch, users should avoid installing or using the 'solana-web3-lts' package version 1.0.0. Conduct a manual review of the package contents if already installed. Prefer using the official '@solana/web3.js' SDK from trusted sources. Monitor for updates or advisories from the package maintainers or security communities regarding this package. Patch status is not yet confirmed — check vendor or repository advisories for current remediation guidance.