# MAL-2026-6509: Malicious code in @merceas/anchor (npm)


- **Type:** Malicious package
- **Package:** `@merceas/anchor` (npm)
- **Published:** 26 Jun 2026

## What is MAL-2026-6509?

MAL-2026-6509 is a malicious package in @merceas/anchor, published on 26 Jun 2026. 

### Official description

Package is published as @merceas/anchor but its README, homepage (https://github.com/coral-xyz/anchor#readme), repository, and source are a verbatim copy of @coral-xyz/anchor — a typosquat/impersonation of the legitimate Solana Anchor SDK. The package.json overrides the standard `cross-fetch` dependency with an npm alias to a fork under the same scope: `"cross-fetch": "npm:@merceas/cross-fetch@3.1.9"`. Installing this package silently pulls @merceas/cross-fetch into the dependency tree, routing every HTTP call made through the SDK (including dist/cjs/utils/registry.js's `https://api.apr.dev/api/v0/program/<id>/latest?limit=<n>` call, and any fetches consumers make via the SDK's transport) through code controlled by the same actor that published this typosquat. The cross-fetch substitution is the attack mechanism: the malicious payload is in the transitive package the installer is forced to pull, not in this tarball.

## What should I do about MAL-2026-6509?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-6509 is a malicious package: @merceas/anchor (npm). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-6509/ (Markdown: https://insights.sbomify.com/MAL-2026-6509/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-6509

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-6509/
Summaries are generated and may contain mistakes; the official description above is the record.