Malicious code in @solana-js/web3 (npm)
@solana-js/web3 (npm) is a malicious typosquat package impersonating the legitimate @solana/web3.js SDK. The package contains a postinstall script that executes arbitrary remote code on Windows systems via hidden PowerShell, downloading and executing a binary payload from files.catbox.moe.
- Disclosed
- Last updated
- Blast radius
- Any Windows developer or system that installed @solana-js/web3 from npm
- Ecosystems
- Attack vectors
- Affected entities
- @solana-js/web3Malicious typosquat impersonating @solana/web3.js
@solana-js/web3 is a typosquat package on npm that impersonates the legitimate @solana/web3.js SDK. The package.json falsely attributes authorship to 'Solana Labs' and lists solana.com as the homepage, increasing the likelihood of accidental installation by developers seeking the real library.
The package exports a non-functional stub API where core Solana client methods (e.g., Connection.getBalance, sendTransaction) return dummy values (0 or random bytes) rather than performing actual blockchain operations. This design allows the malicious code to evade immediate detection during testing.
On installation, the postinstall.js script detects Windows systems and spawns a hidden PowerShell process with obfuscation techniques: base64 encoding, hex-escaping of sensitive API names ('child_process', 'powershell', 'platform', 'win32'), and payload fragmentation. The decoded PowerShell performs an AMSI bypass via reflection against System.Management.Automation.AmsiUtils, then downloads a binary payload from https://files.catbox.moe/a3loxy.bin and executes it in-process using VirtualAlloc and CreateThread, achieving arbitrary remote code execution.
The use of an anonymous, mutable file host (files.catbox.moe) for payload delivery is consistent with known dropper infrastructure patterns and allows the attacker to modify or rotate the payload without republishing the npm package.
Indicators of compromise
- Packages
- @solana-js/web3
- Domains
- files.catbox.moe
Remediation
- Immediately uninstall @solana-js/web3 from all systems, especially Windows hosts
- Use the legitimate @solana/web3.js package instead
- Scan Windows systems that installed this package for malware, particularly checking for unsigned PowerShell execution and VirtualAlloc/CreateThread activity
- Review npm audit logs and CI/CD pipelines for any installation of @solana-js/web3
- Block the domain files.catbox.moe at the network level if possible
- Regenerate any credentials or secrets that may have been exposed on affected systems
Sources
- GitHub Advisory GHSA-v6v8-vghm-gj9m · GitHub Advisory Database
Cite this entry
"Malicious code in @solana-js/web3 (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 13, 2026; last updated August 13, 2026. https://supplychainattack.org/incident/malicious-code-in-solana-js-web3-npm-x517fu
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in @finaxis/common-js (npm)
The npm package @finaxis/common-js was published with a README and keywords copied from lodash v4.18.1, but contained a heavily obfuscated Xelis (XEL) proof-of-work cryptominer instead of lodash functionality. Consumers installing this package would unknowingly run a covert CPU/GPU miner on their systems.
npmCompromised packageTyposquatting - resolvedcritical
Malicious code in depcruise-wrap-stream-in-html (npm)
depcruise-wrap-stream-in-html@99.9.1 is a malicious npm package that mimics an internal helper of dependency-cruiser. It is a hollow package that downloads and executes arbitrary code from a Google Cloud Storage bucket during installation.
npmCompromised packageDependency confusionTyposquatting - resolvedcritical
Malicious code in akamai-sensor (npm)
A malicious npm package named akamai-sensor impersonated Akamai's legitimate sensor_data anti-bot SDK. The package contained hidden JavaScript code concealed using invisible Unicode characters and implemented a dynamic command-and-control channel via a Google Calendar dead-drop, enabling arbitrary code execution on installation.
npmCompromised packageTyposquatting - resolvedcritical
Malicious code in @devmikets/hyperliquid-sdk (npm)
The npm package @devmikets/hyperliquid-sdk contained malicious code that used a typosquatted domain (registrynpmjs.to) to deliver arbitrary code via a fake inquirer dependency. The package impersonated a legitimate Hyperliquid TypeScript SDK to distribute malware to all installers.
npmCompromised packageTyposquatting