Which versions of solana-web3-fork are malicious?

The following npm versions of solana-web3-fork are flagged malicious: 1.0.0. Treat any of these as compromised.

How do I remediate solana-web3-fork if I installed it?

solana-web3-fork is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed solana-web3-fork — how do I know if it already compromised me?

If solana-web3-fork was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is solana-web3-fork part of a known attack campaign?

Yes — solana-web3-fork is associated with the RLMA-2026-05622, IN-MAL-2026-013008, RLUA-2026-06503 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find solana-web3-fork across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for solana-web3-fork (version 1.0.0).

Malicious package

solana-web3-forknpm

Advisory published Jul 20, 2026Updated Sep 1, 2026

solana-web3-fork is a confirmed malicious npm package (MAL-2026-10900) that steals credentials and exfiltrates sensitive data (malicious version 1.0.0). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in solana-web3-fork (npm)

MAL-2026-10900

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall solana-web3-fork

What this malware does

Package name appears to fork or imitate the well-known @solana/web3.js library. Bundled files lib/index.cjs.js and lib/index.esm.js contain co-occurring patterns of child_process usage, fetch/POST/GET calls, and shell utilities (curl, ping) within the same minified bundles. These keyword co-occurrences in a minified Solana SDK fork are concerning but cannot be conclusively distinguished from legitimate SDK behavior (RPC calls, build tooling) without semantic verification of the bundle. Specific hardcoded attacker C2 endpoints, credential-theft paths, or install-time lifecycle hooks have not been confirmed. Given the name-collision with a major crypto SDK and the suspicious pattern stacking in the bundle, manual review is warranted before allowing installer use.

Malicious versions

1 flagged

1.0.0

Indicators of compromise (SHA-256)

1bc559bc0125cc1b97a9049b05819eed10a306fc96bdcf849377be3c164f5007

912cb41aa6b78cf62207dbf95f7d6247238483a800fa9bc6edd9b9d9f7819364

1e247514da2aeddeb3d93f2194b2041beee3594c2b19db6f52b0bac7ee9440f6

Detection & response playbook

Credential / info stealer

Find it
Search your lockfiles and build artifacts for solana-web3-fork (version 1.0.0).
If you installed it — respond
solana-web3-fork is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If solana-web3-fork was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. solana-web3-fork on npm has been identified as a malicious package (version 1.0.0 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

RLMA-2026-05622IN-MAL-2026-013008RLUA-2026-06503

References

Credits

Amazon Inspector · finder
ReversingLabs · finder

Detect & block this

O3 blocks solana-web3-fork-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database