Malicious code in @coralxyz/anchor (npm)
The npm package @coralxyz/anchor is a typosquatting attack impersonating the legitimate @coral-xyz/anchor Solana framework. It contains a postinstall hook that downloads and executes a malicious executable on Windows systems. The package provides no legitimate functionality and serves solely as a dropper for malware.
- Disclosed
- Last updated
- Blast radius
- Any developer or system that installed @coralxyz/anchor on Windows; potential for widespread compromise of Solana development environments.
- Ecosystems
- Attack vectors
- Affected entities
- @coralxyz/anchorMalicious npm package impersonating @coral-xyz/anchor (legitimate Solana Anchor framework)
The malicious npm package @coralxyz/anchor impersonates the legitimate Solana Anchor framework package @coral-xyz/anchor by removing the hyphen from the package name. This is a classic typosquatting attack targeting developers who may mistype the package name during installation.
The package contains obfuscated code in scripts/postinstall.js that uses hex-escaped string-array decoders to hide its true behavior. On Windows systems, the postinstall hook downloads a zip archive from https://files.catbox.moe/9bppy2.zip, extracts it via PowerShell, and executes any .exe files found in the extracted directory with hidden windows.
The package's index.js is a minimal stub with no actual Anchor framework functionality. The postinstall dropper is the sole meaningful behavior, making this a pure malware delivery mechanism. The attack was identified by Amazon Inspector and credited to the OpenSSF malicious-packages project.
Developers who installed @coralxyz/anchor on Windows systems are at risk of having malware executed on their machines during package installation.
Indicators of compromise
- Packages
- @coralxyz/anchor
- Domains
- files.catbox.moe
- Hashes
- 1475ce579e5b1ce9d7597187d091b29b70cbe1a563ed70946517673c29683763
Remediation
- Immediately uninstall @coralxyz/anchor from all systems, especially Windows machines
- Verify you are installing the legitimate @coral-xyz/anchor package (with hyphen) from npm
- Scan Windows systems that may have installed the malicious package for the presence of any.exe or related artifacts from https://files.catbox.moe/9bppy2.zip
- Review npm install logs and package-lock.json files to identify if @coralxyz/anchor was ever installed
- Consider using npm package name verification tools or allowlists to prevent typosquatting attacks
- Update to the latest version of the legitimate @coral-xyz/anchor package if needed
Sources
- GitHub Advisory GHSA-hhj6-h3rr-qc2j · GitHub Advisory Database
Cite this entry
"Malicious code in @coralxyz/anchor (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 8, 2026; last updated August 8, 2026. https://supplychainattack.org/incident/malicious-code-in-coralxyz-anchor-npm-4oadea
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in akamai-sensor (npm)
A malicious npm package named akamai-sensor impersonated Akamai's legitimate sensor_data anti-bot SDK. The package contained hidden JavaScript code concealed using invisible Unicode characters and implemented a dynamic command-and-control channel via a Google Calendar dead-drop, enabling arbitrary code execution on installation.
npmCompromised packageTyposquatting - resolvedcritical
Malicious code in depcruise-wrap-stream-in-html (npm)
depcruise-wrap-stream-in-html@99.9.1 is a malicious npm package that mimics an internal helper of dependency-cruiser. It is a hollow package that downloads and executes arbitrary code from a Google Cloud Storage bucket during installation.
npmCompromised packageDependency confusionTyposquatting - resolvedcritical
Malicious code in @finaxis/common-js (npm)
The npm package @finaxis/common-js was published with a README and keywords copied from lodash v4.18.1, but contained a heavily obfuscated Xelis (XEL) proof-of-work cryptominer instead of lodash functionality. Consumers installing this package would unknowingly run a covert CPU/GPU miner on their systems.
npmCompromised packageTyposquatting - containedcritical
Malicious code in axios-fast (npm)
axios-fast@1.0.1 on npm contains malicious code that exfiltrates environment variables (including AWS credentials, NPM tokens, and GitHub tokens) to an attacker-controlled webhook during package installation. The package typosquats the legitimate axios HTTP client library.
npmCompromised packageTyposquatting