Which versions of solana-web3-community are malicious?

The following npm versions of solana-web3-community are flagged malicious: 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5. Treat any of these as compromised.

How do I remediate solana-web3-community if I installed it?

solana-web3-community is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed solana-web3-community — how do I know if it already compromised me?

If solana-web3-community was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is solana-web3-community part of a known attack campaign?

Yes — solana-web3-community is associated with the IN-MAL-2026-005418, IN-MAL-2026-005419, IN-MAL-2026-005420, RLMA-2026-05620, IN-MAL-2026-013036, IN-MAL-2026-013033, IN-MAL-2026-013035, RLUA-2026-06501 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find solana-web3-community across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for solana-web3-community (6 malicious versions).

Malicious package

solana-web3-communitynpm

Advisory published Jun 11, 2026Updated Sep 1, 2026

solana-web3-community is a confirmed malicious npm package (MAL-2026-5560) that steals credentials and exfiltrates sensitive data (malicious versions 1.0.0, 1.0.1, 1.0.2…). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in solana-web3-community (npm)

MAL-2026-5560

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall solana-web3-community

What this malware does

Package masquerades as the official @solana/web3.js SDK (name solana-web3-community, author 'Solana Labs Maintainers [email protected]', repository solana-foundation/solana-web3.js, homepage solana.com) while exporting the same Connection/Keypair surface to lure Solana developers. On import, lib/index.cjs.js (and the ESM twin lib/index.esm.js) executes a credential-stealing payload that reads ~/.config/solana/id.json, ~/.ssh/id_rsa, ~/.aws/credentials, and project.env files, and iterates process.env collecting any variable whose name matches KEY/SECRET/MNEMONIC/PRIVATE/TOKEN/PASSWORD/AWS/NPM/GITHUB/CI/DEPLOY/SOLANA/ETHERSCAN/ALCHEMY/INFURA. Stolen data is exfiltrated by GET/POST to https://api.telegram.org/bot<BT>/sendMessage with a hardcoded bot token and chat id (BT/CT constants in the bundle). The same module also rewrites ~/.config/solana/cli/config.yml json_rpc_url to http://104.239.66.223:8899, hijacking the victim's Solana CLI to route signed transactions through an attacker-controlled RPC node. A sh() helper invokes child_process.execSync with cwd=$HOME and the module polls the Telegram bot for commands, returning shell output to the attacker — a full remote shell backdoor. Persistence is established by appending an @reboot sleep 90 && node <self> entry to the user's crontab so the payload re-launches across reboots.

Malicious versions

6 flagged

1.0.01.0.11.0.21.0.31.0.41.0.5

Indicators of compromise (SHA-256)

202fa4daf22c4ecace931dfbdbeee6821fe42c14956d35c763c55051528dee12

65a5cce495647c979c3983e1cdd2a9049b8ba484a05e5f201bb7e10bc9dd571e

c45c7686460eaf5f532a9b90f84e6e447d0661657aaf11994acfe77954f3ef91

588804055ed38581a9ecbe940cc24ca01bc3cda94e6492a30ec05bcf7e94c947

6d72194dc9e171231567d5fb3b775b03e24f86237a7f24cd65390eefa06d4baa

7bda905c77f9ae9e65228c3273430b1249f2e2069837be383cf4e1393ba84948

d4fdad2194a0a9fbecc967eb8e1b86d71bddfa5e9461c7eec1e534f57bb3cda5

efa1d1447372422df18fd9199e976dc2eb31b6b252e5e95fda0aa5964772167b

Detection & response playbook

Credential / info stealer

Find it
Search your lockfiles and build artifacts for solana-web3-community (6 malicious versions).
If you installed it — respond
solana-web3-community is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If solana-web3-community was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. solana-web3-community on npm has been identified as a malicious package (versions 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-005418IN-MAL-2026-005419IN-MAL-2026-005420RLMA-2026-05620IN-MAL-2026-013036IN-MAL-2026-013033IN-MAL-2026-013035RLUA-2026-06501

References

Credits

Amazon Inspector · finder
ReversingLabs · finder

Detect & block this

O3 blocks solana-web3-community-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database