Malicious code in web3-terminal (npm)
The npm package 'web3-terminal' version 2.1.6 contains malicious code that executes during installation. It collects sensitive files such as Solana keypairs and environment configurations from the user's system and exfiltrates them to attacker-controlled servers. Additionally, it downloads scanning and blocking patterns to recursively scan and upload matched files from the user's home directory or drives. On Linux systems, it adds an attacker-controlled SSH public key to authorized_keys and modifies firewall rules to allow inbound SSH access, potentially enabling persistent unauthorized access. The package masquerades as legitimate Web3 tooling but has empty metadata, indicating low attribution and targeting of Solana/Web3 developers.
AI Analysis
Technical Summary
The 'web3-terminal' npm package version 2.1.6 contains post-install scripts that perform malicious activities. Upon installation, it runs test.js which calls index.js routines to (1) search the current working directory for sensitive files (id.json, config.toml, .env files) and exfiltrate them via HTTP POST to a remote server at 170.205.31.203:3000; (2) retrieve scanning and blocking patterns from the same attacker-controlled domain and scan the user's home directory or all drives on Windows, uploading matched files to 170.205.31.203:3001; and (3) on Linux, fetch an SSH public key from the attacker server, append it to ~/.ssh/authorized_keys, and execute commands to enable and configure the firewall to allow SSH access. This behavior enables data theft and unauthorized remote access. The package's empty author and description fields and its name resembling legitimate Web3 tools suggest it is a low-attribution malicious package targeting Solana and Web3 developers.
Potential Impact
Sensitive user files including Solana keypairs and environment configurations are exfiltrated to an attacker-controlled server, risking credential and key compromise. The recursive scanning and uploading of matched files from user directories can lead to extensive data leakage. On Linux systems, the addition of an attacker-controlled SSH key and firewall modifications allow persistent unauthorized remote access, potentially enabling full system compromise. This threat can result in loss of confidentiality, integrity, and availability of affected systems and data.
Mitigation Recommendations
No official patch or remediation is currently available for this malicious package. Users should avoid installing version 2.1.6 of 'web3-terminal' and remove it if already installed. Verify the integrity and provenance of npm packages before installation, especially those with empty or suspicious metadata. Monitor for unexpected SSH authorized_keys changes and firewall rule modifications on Linux systems. Since this is a malicious package rather than a traditional vulnerability, remediation involves removal and prevention of installation rather than patching.
Malicious code in web3-terminal (npm)
Description
The npm package 'web3-terminal' version 2.1.6 contains malicious code that executes during installation. It collects sensitive files such as Solana keypairs and environment configurations from the user's system and exfiltrates them to attacker-controlled servers. Additionally, it downloads scanning and blocking patterns to recursively scan and upload matched files from the user's home directory or drives. On Linux systems, it adds an attacker-controlled SSH public key to authorized_keys and modifies firewall rules to allow inbound SSH access, potentially enabling persistent unauthorized access. The package masquerades as legitimate Web3 tooling but has empty metadata, indicating low attribution and targeting of Solana/Web3 developers.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The 'web3-terminal' npm package version 2.1.6 contains post-install scripts that perform malicious activities. Upon installation, it runs test.js which calls index.js routines to (1) search the current working directory for sensitive files (id.json, config.toml, .env files) and exfiltrate them via HTTP POST to a remote server at 170.205.31.203:3000; (2) retrieve scanning and blocking patterns from the same attacker-controlled domain and scan the user's home directory or all drives on Windows, uploading matched files to 170.205.31.203:3001; and (3) on Linux, fetch an SSH public key from the attacker server, append it to ~/.ssh/authorized_keys, and execute commands to enable and configure the firewall to allow SSH access. This behavior enables data theft and unauthorized remote access. The package's empty author and description fields and its name resembling legitimate Web3 tools suggest it is a low-attribution malicious package targeting Solana and Web3 developers.
Potential Impact
Sensitive user files including Solana keypairs and environment configurations are exfiltrated to an attacker-controlled server, risking credential and key compromise. The recursive scanning and uploading of matched files from user directories can lead to extensive data leakage. On Linux systems, the addition of an attacker-controlled SSH key and firewall modifications allow persistent unauthorized remote access, potentially enabling full system compromise. This threat can result in loss of confidentiality, integrity, and availability of affected systems and data.
Mitigation Recommendations
No official patch or remediation is currently available for this malicious package. Users should avoid installing version 2.1.6 of 'web3-terminal' and remove it if already installed. Verify the integrity and provenance of npm packages before installation, especially those with empty or suspicious metadata. Monitor for unexpected SSH authorized_keys changes and firewall rule modifications on Linux systems. Since this is a malicious package rather than a traditional vulnerability, remediation involves removal and prevention of installation rather than patching.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-11007
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a6150ef9c2644c7f8da2eee
Added to database: 07/22/2026, 23:23:27 UTC
Last enriched: 07/22/2026, 23:43:15 UTC
Last updated: 07/22/2026, 23:43:15 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.