solana-core-4@1.0.0
Malicious code in solana-core-4 (npm)
T1195.002 · Compromise Software Supply ChainT1059.007 · JavaScriptT1082 · System Information DiscoveryT1552.001 · Credentials In FilesT1005 · Data from Local SystemT1041 · Exfiltration Over C2 Channel
Analysis
Confirmed crypto-wallet/credential stealer published as solana-core-4 combosquat. Postinstall hook runs src/index.js which collects Solana/Ethereum/Bitcoin/Tron wallet key files, SSH private keys, .env secrets, and mnemonic/seed files, then exfiltrates all of them via api[.]telegram[.]org/bot[redacted-credential]/sendDocument to a hardcoded Telegram chat. Uses 4941ms setTimeout to evade sandbox detection. Publisher aicrypto-xzggz / [account] is a throwaway account.
- analyzed by
- Leitwacht
- first seen
- Jun 9, 2026, 02:49 AM
- analyzed
- Jun 9, 2026, 02:50 AM
Related advisories
- ethereum-kit-1@1.0.0
- solana-web3-stable@1.0.0
- solana-rpc-client@1.0.0
- solana-web3-patched@1.0.0
- solana-web3-fixed@1.0.0
- solana-js-client@1.0.0
- solana-web3-fork@1.0.0
- solana-web3-v1@1.0.0
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.