Malicious code in solana-web3-v1 (npm)

The solana-web3-v1 package on npm, version 1.0.0, is flagged due to name confusion with the official @solana/web3.js SDK and the presence of potentially dangerous code patterns such as child_process invocation, network fetch calls, and shell commands (curl, ping) bundled together. These combined indicators raise suspicion of malicious intent, possibly as a lure for confusion attacks. However, without dynamic execution tracing, it is not confirmed whether these features are active or dead code, nor if the network calls serve legitimate SDK functions or data exfiltration. No vendor advisory or patch information is available.

If malicious, the package could execute arbitrary shell commands and perform unauthorized network communications, potentially leading to system compromise or data exfiltration when installed and used. The name confusion increases the risk of accidental installation by developers expecting the legitimate Solana SDK. No known active exploits have been reported.

No official patch or remediation is currently available. Users should avoid installing the solana-web3-v1 package version 1.0.0. Verify package authenticity by using the official @solana/web3.js SDK from trusted sources. Conduct manual code review and dynamic analysis before use. Monitor for vendor advisories or updates regarding this package.