# MAL-2026-5788: Malicious code in @solana-labs/web3js (npm)


- **Type:** Malicious package
- **Package:** `@solana-labs/web3js` (npm)
- **Published:** 15 Jun 2026
- **Also known as:** GHSA-pqhf-q5g8-6jpm

## What is MAL-2026-5788?

MAL-2026-5788 is a malicious package in @solana-labs/web3js, published on 15 Jun 2026. 

### Official description

Package name `@solana-labs/web3js` closely resembles the well-known `@solana/web3.js` library (different scope, missing dot in module name). The bundled `lib/index.cjs.js` and `lib/index.esm.js` are large minified blobs that include `require('child_process')`, `fetch(`, `POST`, `curl`, and `ping` strings, but the bundle is consistent in shape with a Solana web3 client SDK (RPC client, websocket subscriptions, JSON-RPC POST calls to user-configured endpoints). The keyword co-occurrence in a minified rollup bundle does not by itself confirm exfiltration: a JSON-RPC client legitimately POSTs to caller-supplied RPC URLs, and `child_process` references can come from bundled diagnostics or test utilities pulled into the rollup. No lifecycle script, top-level network beacon, or hardcoded attacker endpoint has been confirmed in the traced code. The primary concern is name/scope confusion against the official `@solana/web3.js` package, which carries real installer risk if developers select the wrong dependency. Routing to human review to (a) confirm whether the scope `@solana-labs` is an official Solana publisher or a lookalike, and (b) de-minify the relevant spans of the bundle to confirm the network calls are caller-configured RPC endpoints rather than a hardcoded C2.

## What should I do about MAL-2026-5788?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-5788 is a malicious package: @solana-labs/web3js (npm). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-5788/ (Markdown: https://insights.sbomify.com/MAL-2026-5788/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-5788

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-5788/
Summaries are generated and may contain mistakes; the official description above is the record.