MAL-2026-10591 Malicious code in solana-key-utils (npm)
Malicious package
Published
MAL-2026-10591 is a malicious package: solana-key-utils (npm). Every version was published to cause harm.
Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.
Reference: https://insights.sbomify.com/MAL-2026-10591/ (Markdown: https://insights.sbomify.com/MAL-2026-10591/index.md)
- Package
- solana-key-utils
- Registry
- npm
What is MAL-2026-10591?
MAL-2026-10591 is a malicious package in solana-key-utils, published on 14 Jul 2026.
Official description
On require(), index.js waits 37 seconds, reads test/fixtures/keypairs.dat (a 53KB base64 blob disguised as a test fixture, no test harness references it), base64-decodes it to ~39KB of opaque JavaScript, writes the result to ~/.cache-db/.node-sync/syncd.js with mode 0700, and spawns 'node syncd.js' detached with stdio ignored. The package then installs scheduled persistence on all three major platforms: a crontab entry running the dropped script every 12 hours on Linux, a scheduled task named 'WinNodeSync' on Windows via schtasks, and a LaunchAgent at ~/Library/LaunchAgents/com.apple.syncd.plist on macOS with RunAtLoad and StartInterval 43200. The dropped payload then re-executes every 12 hours independent of the original require, giving whoever published the package persistent code execution on the installer's machine. The 'solana-key-utils' name and 'test fixture' framing are cover for the smuggled executable payload.
What should I do about MAL-2026-10591?
Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.