{"answers":{"affected":"1 open source package ship an affected version, including @solana-labs/ancor.","exploited":"There is no known exploitation of MAL-2026-5786 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-5786 is a malicious package in @solana-labs/ancor, published on 15 Jun 2026."},"fix_prompt":"MAL-2026-5786 is a malicious package: @solana-labs/ancor (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-5786/ (Markdown: https://insights.sbomify.com/MAL-2026-5786/index.md)","id":"MAL-2026-5786","markdown":"https://insights.sbomify.com/MAL-2026-5786/index.md","name":"MAL-2026-5786","record":{"aliases":["GHSA-h2x5-cj9x-hvcc"],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"Package is published as `@solana-labs/ancor` — a name one character off from `anchor`, the well-known Solana smart-contract framework (published as `@coral-xyz/anchor`, formerly `@project-serum/anchor`). The `@solana-labs` scope and the near-miss spelling `ancor` together create high confusion potential for developers searching for the Anchor framework. The shipped bundles `lib/index.cjs.js` and `lib/index.esm.js` are large minified rollups (~11k+ lines) that include `require('child_process')`, `fetch(...)` POST calls, and references to `curl` / `ping`. Pattern matches on keyword co-occurrence in a minified bundle do not by themselves prove malicious intent — Anchor and similar frameworks legitimately bundle child_process and HTTP for build/CLI tooling — but the combination of a typosquat-shaped name, a vendor-impersonating scope, and a large opaque bundle warrants human review before this version is allowed into installer environments. A reviewer should verify scope ownership (is `@solana-labs` actually controlled by Solana Labs, or a squatted scope?), de-minify the flagged regions around lines 5016/5046 and 11336/11441 to confirm whether the POST/fetch destinations and child_process spawns are part of a documented build/CLI flow or an exfiltration path, and compare bundle behavior against legitimate `@coral-xyz/anchor`.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in @solana-labs/ancor (npm)","id":"MAL-2026-5786","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"@solana-labs/ancor","purl":"pkg:npm/%40solana-labs/ancor","source":"MAL-2026-5786"}],"products":null,"published":"2026-06-15","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-5786/"}