{"answers":{"affected":"1 open source package ship an affected version, including @solana-labs/web3js.","exploited":"There is no known exploitation of MAL-2026-5788 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-5788 is a malicious package in @solana-labs/web3js, published on 15 Jun 2026."},"fix_prompt":"MAL-2026-5788 is a malicious package: @solana-labs/web3js (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-5788/ (Markdown: https://insights.sbomify.com/MAL-2026-5788/index.md)","id":"MAL-2026-5788","markdown":"https://insights.sbomify.com/MAL-2026-5788/index.md","name":"MAL-2026-5788","record":{"aliases":["GHSA-pqhf-q5g8-6jpm"],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"Package name `@solana-labs/web3js` closely resembles the well-known `@solana/web3.js` library (different scope, missing dot in module name). The bundled `lib/index.cjs.js` and `lib/index.esm.js` are large minified blobs that include `require('child_process')`, `fetch(`, `POST`, `curl`, and `ping` strings, but the bundle is consistent in shape with a Solana web3 client SDK (RPC client, websocket subscriptions, JSON-RPC POST calls to user-configured endpoints). The keyword co-occurrence in a minified rollup bundle does not by itself confirm exfiltration: a JSON-RPC client legitimately POSTs to caller-supplied RPC URLs, and `child_process` references can come from bundled diagnostics or test utilities pulled into the rollup. No lifecycle script, top-level network beacon, or hardcoded attacker endpoint has been confirmed in the traced code. The primary concern is name/scope confusion against the official `@solana/web3.js` package, which carries real installer risk if developers select the wrong dependency. Routing to human review to (a) confirm whether the scope `@solana-labs` is an official Solana publisher or a lookalike, and (b) de-minify the relevant spans of the bundle to confirm the network calls are caller-configured RPC endpoints rather than a hardcoded C2.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in @solana-labs/web3js (npm)","id":"MAL-2026-5788","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"@solana-labs/web3js","purl":"pkg:npm/%40solana-labs/web3js","source":"MAL-2026-5788"}],"products":null,"published":"2026-06-15","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-5788/"}