Threats Tagged 'mal-2026-5788'

The package '@solana-labs/web3js' on npm closely mimics the official '@solana/web3.js' library but under a different scope and with a slightly altered name. The package contains large minified bundles referencing child_process and network-related strings such as fetch, POST, curl, and ping. However, no direct evidence of malicious network beacons, hardcoded attacker endpoints, or lifecycle scripts has been confirmed. The main risk arises from potential confusion leading developers to install this lookalike package instead of the legitimate one. Further human review is needed to verify if '@solana-labs' is an official publisher and to analyze the network calls for any hidden command and control behavior.

The npm package '@solana-labs/web3.js' is a malicious impersonation of the legitimate '@solana/web3.js' package. During installation, it runs a postinstall script that performs sandbox evasion checks and, if not detected, steals sensitive credentials and crypto keys from the victim's environment. It exfiltrates this data to an attacker-controlled Telegram bot and establishes a reverse-shell backdoor for remote command execution. Persistence is maintained via a cron job, and a hardcoded Solana wallet address is used for theft.