NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
Malicious package

@solana-labs/web3-jsnpm

Advisory published Updated

@solana-labs/web3-js is a confirmed malicious npm package (MAL-2026-5363) that steals credentials and exfiltrates sensitive data (malicious versions 1.0.0, 1.0.5, 1.0.6…). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in @solana-labs/web3-js (npm)

MAL-2026-5363
Immediate action
Remove the package, then rotate any secrets the build/runtime could reach.
npm uninstall @solana-labs/web3-js

What this malware does

Package name @solana-labs/web3-js impersonates the legitimate @solana/web3.js and index.js simply re-exports the real package as cover. The postinstall hook in package.json runs node install.js, which executes a full attack chain on every install: (1) XOR-decodes a hardcoded Telegram bot token and chat id; (2) collect() reads installer secrets from ~/.ssh/id_rsa, ~/.aws/credentials, ~/.config/solana/id.json, ~/.solana/id.json, project and system .env files (/root/.env, /home/node/.env, /app/.env), and scrapes process.env for variables matching /KEY|SECRET|MNEMONIC|PRIVATE|TOKEN|AWS|NPM|GITHUB/i; (3) exfilNow() POSTs the harvested secrets in chunks to api.telegram.org/bot<token>/sendMessage; (4) writes /tmp/.cron-tmp and pipes it through crontab - to install an @reboot sleep 90 && node install.js persistence entry; (5) enters an infinite c2Loop() polling Telegram getUpdates and dispatching attacker-supplied /sh, /cmd, /keys, /ssh, /env, /wallet commands through execSync, giving the operator arbitrary remote code execution. An HMAC AUTH_SECRET and the bot credentials are XOR-obfuscated, with an in-source comment acknowledging anti-scanner intent.

The OpenSSF Package Analysis project identified '@solana-labs/web3-js' @ 1.0.0 (npm) as malicious.

It is considered malicious because:

  • The package communicates with a domain associated with malicious activity.

  • The package executes one or more commands associated with malicious behavior.

Malicious versions

7 flagged
1.0.01.0.51.0.61.0.71.0.81.0.101.98.112

Indicators of compromise (SHA-256)

99d2ea7302fd72532bbe21dd885a0c456599e7fb1e8055977e35ae563236e530
d11c336c71c73260c2daa9233636b07bc81badb0b9f54b13241f719710a7f5d4
b0a2c42af0287251c2984acfc704f106684740113ea40c5da378c62fc4a69e21
b9f6f76bf8c61d3aacdd2f3090638e8f080cc0824638655b3fb72dd37b3f30ce
27d70184288101b007929fe8779472e5cab94bc2bb27bfc7db170a8774775e65
2a977c26713c23cf6aaee3b5665ac25d2478e37902ba90ce4e5fdd3ee4f7c4e0
8200c48d8eb6b5f99656b98a2b2cfd846debfeff47c427f4df7282570b3d3320
98c4ea935a335d409c1404e6ec17048a25e042e91d8bafbe1f0b7fd40186e4a4
9df98dc6306fe496317b40360eaa2b6238a6b2af8b60b5c390e4f3750e3fec9d

Detection & response playbook

Credential / info stealer

  1. Find it

    Search your lockfiles and build artifacts for @solana-labs/web3-js (7 malicious versions).

  2. If you installed it — respond

    @solana-labs/web3-js is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

  3. Did it already run?

    If @solana-labs/web3-js was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. @solana-labs/web3-js on npm has been identified as a malicious package (versions 1.0.0, 1.0.5, 1.0.6, 1.0.7, 1.0.8, 1.0.10, 1.98.112 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-005290IN-MAL-2026-005409IN-MAL-2026-005406IN-MAL-2026-005405IN-MAL-2026-005408IN-MAL-2026-005407IN-MAL-2026-005403IN-MAL-2026-005404

References

Credits

  • Amazon Inspector · finder
  • OpenSSF: Package Analysis · finder

Detect & block this

O3 blocks @solana-labs/web3-js-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database
@solana-labs/web3-js (npm) malicious package — MAL-2026-5363 | O3 Security