MAL-2026-5861 Malicious code in solana-mev-bot (npm)
Malicious package
Published
MAL-2026-5861 is a malicious package: solana-mev-bot (npm). Every version was published to cause harm.
Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.
Reference: https://insights.sbomify.com/MAL-2026-5861/ (Markdown: https://insights.sbomify.com/MAL-2026-5861/index.md)
- Package
- solana-mev-bot
- Registry
- npm
What is MAL-2026-5861?
MAL-2026-5861 is a malicious package in solana-mev-bot, published on 16 Jun 2026.
Official description
bot.js performs a hardcoded HTTPS GET to api.telegram.org's bot sendMessage endpoint, transmitting host fingerprint data collected via os.hostname(), os.userInfo(), and process.platform. The file also imports child_process and reads from the filesystem (fs.existsSync / fs.readFileSync) alongside the network exfiltration primitive. The destination is an attacker-operated Telegram bot, used as an exfiltration channel to siphon installer host identity and likely credential/wallet material from disk. The package name impersonates a Solana MEV trading utility to lure crypto users into running it.
What should I do about MAL-2026-5861?
Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.
Sources
Also known as GHSA-8gg8-q73f-wv82.