spl-token-utils (npm) · Malicious Code
Affects spl-token-utilsSource GCVE Database
Malicious package : remove spl-token-utils and rotate any secrets on hosts that installed it.
Data as of 5 Aug 2026, 23:00 UTC
Malicious package
Published to npm · OSV MAL-2026-13351
What to do
Remove spl-token-utils from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmspl-token-utils | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The spl-token-utils npm package version 1.4.2 is a malicious typosquat of the legitimate @solana/spl-token package. Upon import, it collects the entire process environment variables along with system metadata and exfiltrates this data via an HTTPS request to a Telegram bot. It suppresses repeated data sends using a marker file and attempts to maintain functional behavior by re-exporting the real @solana/spl-token package. This behavior captures sensitive credentials present in the environment, such as cloud keys and tokens, which are unrelated to the package's intended functionality.