Malicious code in spl-token-utils (npm)
The npm package spl-token-utils contained malicious code that exfiltrated process environment variables (including credentials) to a Telegram bot on installation. The package used typosquatting to impersonate the legitimate @solana/spl-token library while harvesting sensitive data at import time.
- Disclosed
- Last updated
- Blast radius
- Any developer or CI/CD system that installed spl-token-utils from npm, potentially exposing environment variables including cloud credentials, CI/publish tokens, and database URLs.
- Ecosystems
- Attack vectors
- Affected entities
- spl-token-utilsMalicious npm package masquerading as @solana/spl-token replacement
The npm package spl-token-utils was found to contain malicious code that executed on require. Upon import, the index.js file serialized the full process.env object along with system metadata (hostname, username, homedir, platform, cwd, and package metadata), base64-encoded the payload, and sent it via HTTPS GET request to api.telegram.org/bot/sendMessage with a hardcoded chat_id (8969499041).\n\nThe package was designed as a typosquat of the legitimate @solana/spl-token library, using a similar name (spl-token-utils) to increase the likelihood of accidental installation. It attempted to require and re-export the real @solana/spl-token to maintain functional behavior for consumers while the exfiltration occurred silently in the background.\n\nThe malicious code harvested bulk process environment variables at import time, capturing any credentials available to the Node process running the installer—including cloud keys, CI/publish tokens, and database URLs. A marker file in the OS tmpdir was used to suppress repeat sends of the exfiltrated data.\n\nThe incident was identified and credited to the OpenSSF malicious-packages project. The package has been removed from npm and the threat is contained.
Indicators of compromise
- Packages
- spl-token-utils
- Domains
- api.telegram.org
Remediation
- Immediately uninstall spl-token-utils from all projects and CI/CD systems
- Audit npm package.json and lock files for any presence of spl-token-utils
- Rotate all credentials and secrets that may have been exposed (cloud keys, CI tokens, database URLs, API keys)
- Review process.env logs and audit trails for any suspicious access during the period the package was installed
- Use the legitimate @solana/spl-token package instead
- Implement npm package name verification and typosquat detection in dependency management workflows
- Consider using npm audit or similar tools to detect known malicious packages
Sources
- GitHub Advisory GHSA-m332-52xq-8h47 · GitHub Advisory Database
Cite this entry
"Malicious code in spl-token-utils (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 5, 2026; last updated August 5, 2026. https://supplychainattack.org/incident/malicious-code-in-spl-token-utils-npm-sypuq1
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in @coralxyz/anchor (npm)
The npm package @coralxyz/anchor is a typosquatting attack impersonating the legitimate @coral-xyz/anchor Solana framework. It contains a postinstall hook that downloads and executes a malicious executable on Windows systems. The package provides no legitimate functionality and serves solely as a dropper for malware.
npmTyposquattingCompromised package - containedcritical
Malicious code in @nestjs-passport/jwt (npm)
A malicious npm package @nestjs-passport/jwt was published under a scope resembling official NestJS packages. The package contains JSFuck-encoded obfuscated code (~2.3MB) that executes hidden functionality at require/import time in the installer's Node process.
npmTyposquattingCompromised package - containedcritical
Malicious code in dolyame-ui-datatable (npm)
The npm package dolyame-ui-datatable contains malicious code that downloads and executes platform-specific binaries from attacker-controlled infrastructure. The package is a typosquat/dependency-confusion carrier with no legitimate UI or datatable functionality, only loader and dropper code.
npmCompromised packageTyposquatting - activecritical
Malicious code in hardhat-set (npm)
The npm package hardhat-set contains malicious obfuscated code disguised with a copied pino logger README. The package executes a multi-megabyte obfuscated payload on import, delivering hidden malware to anyone who installs or requires it.
npmTyposquattingCompromised package