MAL-2026-11533 Malicious code in @zzzgenesis00/solana-web3 (npm)
Malicious package
Published
MAL-2026-11533 is a malicious package: @zzzgenesis00/solana-web3 (npm). Every version was published to cause harm.
Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.
Reference: https://insights.sbomify.com/MAL-2026-11533/ (Markdown: https://insights.sbomify.com/MAL-2026-11533/index.md)
- Package
- @zzzgenesis00/solana-web3
- Registry
- npm
What is MAL-2026-11533?
MAL-2026-11533 is a malicious package in @zzzgenesis00/solana-web3, published on 4 Aug 2026.
Official description
This package impersonates Solana Labs (author field 'solana-labs', repository pointing at github.com/solana-labs/solana-web3) under an unrelated scope. Its postinstall.js runs automatically on npm install and, after a 1.5-3.5 second randomized delay, harvests installer-owned secrets: files under ~/.ssh, ~/.npmrc, ~/.gitconfig, Chrome/Firefox profile artifacts (Cookies, Login Data, key4.db), and cryptocurrency wallet directories (.bitcoin,.ethereum,.solana,.metamask,.exodus, and Electrum/Exodus AppData). It also iterates a hardcoded list of credential-shaped environment variables (NPM_TOKEN, NODE_AUTH_TOKEN, GITHUB_TOKEN, AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY / AWS_SESSION_TOKEN, DOCKER_PASSWORD, GCLOUD_ACCESS_TOKEN, MNEMONIC, SEED_PHRASE, multiple *_PRIVATE_KEY variables, and HELIUS/INFURA/ALCHEMY API keys). The collected profile is transmitted to two attacker-controlled destinations: the Telegram Bot API (bot 7231970337, chat_id 7231970337) via GET, and a serveo.net dynamic tunnel host at 40f955f39128bd79-178-249-214-24.serveousercontent.com via POST /collect. Variable identifiers in the script are masked (_jku, _wjn, _hyz, _ht, _tk, _ch) and the exfiltration is deferred behind a randomized timer to evade observation during install.
What should I do about MAL-2026-11533?
Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.