Malicious code in solana-web3-stable (npm)

The 'solana-web3-stable' npm package (version 1.0.0) closely resembles the legitimate Solana client library '@solana/web3.js', raising typosquatting concerns. Its bundled minified files include co-located usage of child_process, hardcoded network fetch/POST calls, and shell utilities (curl, ping), which could indicate malicious behavior such as exfiltration. However, the captured evidence does not confirm malicious intent, as these features could also be consistent with legitimate Solana RPC interactions. Human review is required to determine if network destinations are legitimate Solana RPC endpoints or attacker-controlled, and whether child_process is invoked during install or import.

If malicious, this package could execute arbitrary shell commands and perform unauthorized network communications, potentially leading to code execution or data exfiltration on systems that install or import it. However, no confirmed exploitation or active attacks have been reported.

No official patch or remediation is currently available. Users should avoid installing or using the 'solana-web3-stable' package version 1.0.0. Verify the authenticity of Solana client libraries by using the official '@solana/web3.js' package from trusted sources. Conduct manual review of network destinations and child_process usage if the package is already in use.