{"answers":{"affected":"1 open source package ship an affected version, including @merceas/anchor.","exploited":"There is no known exploitation of MAL-2026-6509 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-6509 is a malicious package in @merceas/anchor, published on 26 Jun 2026."},"fix_prompt":"MAL-2026-6509 is a malicious package: @merceas/anchor (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-6509/ (Markdown: https://insights.sbomify.com/MAL-2026-6509/index.md)","id":"MAL-2026-6509","markdown":"https://insights.sbomify.com/MAL-2026-6509/index.md","name":"MAL-2026-6509","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"Package is published as @merceas/anchor but its README, homepage (https://github.com/coral-xyz/anchor#readme), repository, and source are a verbatim copy of @coral-xyz/anchor — a typosquat/impersonation of the legitimate Solana Anchor SDK. The package.json overrides the standard `cross-fetch` dependency with an npm alias to a fork under the same scope: `\"cross-fetch\": \"npm:@merceas/cross-fetch@3.1.9\"`. Installing this package silently pulls @merceas/cross-fetch into the dependency tree, routing every HTTP call made through the SDK (including dist/cjs/utils/registry.js's `https://api.apr.dev/api/v0/program/\u003cid\u003e/latest?limit=\u003cn\u003e` call, and any fetches consumers make via the SDK's transport) through code controlled by the same actor that published this typosquat. The cross-fetch substitution is the attack mechanism: the malicious payload is in the transitive package the installer is forced to pull, not in this tarball.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in @merceas/anchor (npm)","id":"MAL-2026-6509","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"@merceas/anchor","purl":"pkg:npm/%40merceas%2Fanchor","source":"MAL-2026-6509"}],"products":null,"published":"2026-06-26","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-6509/"}