Malicious code in @baanx/solana-lib (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (6462ecac2764fc9cf78d47ee57fec1fd3d6a0cf573ee02eaddcc2e5b5f3f0d7e) The package declares `scripts.install` = `node index.js`, so `npm install @baanx/solana-lib` automatically executes `index.js`, which loads `lib/core.js`. That module reads the installer's username (`os.userInfo().username`), hostname (`os.hostname()`), and current working directory basename, concatenates them with a timestamp and the static prefix `bxsol`, and issues a `dns.resolve4()` lookup against `.....oob.algamil7x.xyz` — a DNS-based out-of-band beacon that leaks installer identity to a hardcoded non-first-party domain. Helper modules `lib/e5f0a2.js` and `lib/f6a1b3.js` reconstruct the strings `os`, `dns`, `userInfo`, `hostname`, `cwd`, `resolve4`, the prefix `bxsol`, and the destination host `oob.algamil7x.xyz` from `String.fromCharCode` byte arrays, and load Node builtins indirectly via `module.constructor._load('os')` / `_load('dns')` to conceal the behavior. The package is presented as a Solana library; the char-code-obfuscated destination and the install-time host-recon beacon are inconsistent with any legitimate Solana functionality. ## Source: ghsa-malware (ae13a6ad6865a2910cfb51f6e69cfa625450b6e017c846e702cc216e69cb0abe) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different comp
MAL-2026-16300
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:MAL-2026-16300
@baanx/solana-lib
Source reference: /affected/0/package/name
- Affected versions
- 9.9.10
Source reference:
/affected/0/versions9.9.9Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "@baanx/solana-lib",
"purl": "pkg:npm/%40baanx/solana-lib",
"ecosystem": "npm"
},
"versions": [
"9.9.10",
"9.9.9"
],
"database_specific": {
"cwes": [
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
}
],
"source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@baanx/solana-lib/MAL-2026-16300.json",
"indicators": {
"evidence_files": [
{
"path": "lib/core.js",
"tlsh": "36f0a229b3a3c08fa7e092d0361a43d18459c3c0d7cf4191fb7c0e87904e7d1cac596a",
"sha256": "6b930c020246e5d616d754ba88c612a92ace1b5b51dc26cedd0bb0032d6faef4"
},
{
"path": "lib/f6a1b3.js",
"tlsh": "efe0201b25afe14fa6e85ee72f17d4dac8920e00e21d4bd9f91d0687206a007c0c0770",
"sha256": "722c82e72c54a47cc5390ee243e7a19f3843ce3d5759751f9a05b31a2c2d7f49"
}
],
"package_integrity": [
{
"hashes": {
"sha1": "b87b5380d6227dfaf0bd7ef43fb1840f1b4bddaf",
"sha512_sri": "sha512-l/huo77kYbinGs6lKg46g54IdORPVKMZywhfgvirXWCtDXy1N3GQpt7lP+kZEHUq8FLEN1tqdFY+AxgEWbP12Q=="
},
"filename": "solana-lib-9.9.10.tgz"
}
]
}
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #33413 · Revision 1
- Added to Heist Feed
- Publisher date