Which versions of solana-web3 are malicious?

The following PyPI versions of solana-web3 are flagged malicious: 1.0.0. Treat any of these as compromised.

How do I remediate solana-web3 if I installed it?

solana-web3 is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed solana-web3 — how do I know if it already compromised me?

If solana-web3 was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.

Is solana-web3 part of a known attack campaign?

Yes — solana-web3 is associated with the 2026-06-spl-token-py, IN-MAL-2026-005416 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find solana-web3 across my projects, lockfiles, and CI pipelines?

Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for solana-web3 (version 1.0.0). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging solana-web3 across your stack and pipelines.

Malicious package

solana-web3PyPI

Malicious code in solana-web3 (PyPI) Remove it immediately and rotate any exposed credentials.

MAL-2026-5337

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

pip uninstall solana-web3

What this malware does

On import, solana-web3/init.py executes a credential-stealer payload. After a sandbox-evasion gate (checks for 12-hex Docker hostname, /.dockerenv, and presence of strace to skip analysis environments), _collect() reads installer-side secrets: ~/.ssh/id_rsa, ~/.ssh/id_ed25519, ~/.aws/credentials, Solana keypairs at ~/.config/solana/id.json and ~/.solana/id.json,.env files in the current and parent directories as well as /app/.env and /root/.env, and bulk-scrapes os.environ for any variable name containing KEY/SECRET/MNEMONIC/PRIVATE/TOKEN/PASSWORD/AWS/NPM/GITHUB/SOLANA. The harvested data is POSTed to https://api.telegram.org/bot<redacted>/sendMessage using a hardcoded bot token and chat_id 8346336575. _persist() then writes @reboot sleep 90 && python3 <__file__> into /tmp/.psync and merges it into the user's crontab so the stealer re-runs on every reboot, even after the package is uninstalled. The package name impersonates the well-known @solana/web3.js Solana SDK and advertises itself as a 'Community-maintained Solana Python SDK', but ships no SDK functionality — only the stealer. METADATA lists UNKNOWN homepage/license and a generic 'Solana Dev Community' author.

During import, the package exfiltrates sensitive data (credentials, SSH keys, cryptowallet's data). It also establishes persistence via a cronjob.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-06-spl-token-py

Reasons (based on the campaign):

crypto-related
typosquatting
exfiltration-ssh-keys
exfiltration-credentials
exfiltration-crypto
exfiltration-env-variables
persistence
uses-telegram-bot
The package contains code to detect if it is running in a sandbox environment.

Malicious versions

1 flagged

1.0.0

Indicators of compromise (SHA-256)

91c09b86579a07d271d3bcd57adf5b5b161e49e36c3bd7af09c50dd8127aa54f

4967ebad2d1f4f5802ef50f1d399c05c4dfab94a208079695570b15ffef0fdd2

d413be5ab63f611c2afc6583df30b5167044189a3c1c9248cc9c3910a77bb974

Detection & response playbook

Credential / info stealer

Find it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for solana-web3 (version 1.0.0). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging solana-web3 across your stack and pipelines.
If you installed it — respond
solana-web3 is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If solana-web3 was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks solana-web3 before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.

Frequently asked questions

No. solana-web3 on PyPI has been identified as a malicious package (version 1.0.0 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

2026-06-spl-token-pyIN-MAL-2026-005416

References

Credits

Amazon Inspector · finder
Kamil Mańkowski (kam193) · reporter

Detect & block this

O3 blocks solana-web3-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database