Malicious code in solana-web3-patched (npm)

The 'solana-web3-patched' package (version 1.0.0) is an unscoped npm package designed to resemble the legitimate '@solana/web3.js' library. Analysis reveals the presence of child_process imports alongside network communication primitives (fetch, POST, GET) and shell utilities (curl, ping) within the same bundled files. This combination is unusual for a standard Solana RPC client and raises suspicion of malicious intent, possibly enabling remote command execution or data exfiltration. However, the exact reachability and impact of these code paths at install or runtime have not been conclusively determined due to lack of traced-code corroboration. The package is flagged for human review to verify if any hardcoded destinations are attacker-controlled and if the suspicious code is executed during installation or usage.

If executed, the malicious code could allow attackers to run arbitrary shell commands and send outbound network requests, potentially leading to data exfiltration or system compromise. The typosquatting nature increases the risk of inadvertent installation by users expecting the legitimate Solana library. No known active exploits have been reported so far.

Avoid installing or using the 'solana-web3-patched' package. Verify package names carefully to prevent typosquatting attacks. Since no official patch or fix exists for this malicious package, the best mitigation is to remove it from any environments where it is installed and rely only on the official '@solana/web3.js' package from trusted sources. Conduct manual code review if the package must be used for any reason.