sjs-builder@1.0.5
Malicious code in sjs-builder (npm)
T1620 · Reflective Code Loading
Analysis
On require/import, sjs-builder sends a POST request to api[.]devnet[.]solana[.]com with a getAccountInfo JSON-RPC call for hardcoded wallet address 4WF8QCFEnVD7BLs3QAVe2SjxRZ4n3EboCsdhj363VAqZ. It decodes the returned account data, extracts JavaScript source code from byte offset 36, and executes it via new Function("require","module","exports",src). This allows the wallet controller to remotely change the executed payload at any time without updating the npm package. The wallet address is on the Solana devnet and the RPC endpoint is api[.]devnet[.]solana[.]com.
- analyzed by
- Leitwacht
- first seen
- Jun 14, 2026, 12:48 AM
- analyzed
- Jun 14, 2026, 12:57 AM
Related advisories
- codyx-ai-windows-x64-baseline@1.14.42
- codyx-ai-windows-x64@1.14.42
- codyx-ai-darwin-x64-baseline@1.14.42
- seed-to-private@1.0.1
- scraping-master@0.1.11
- scraping-master@0.1.10
- scraping-master@0.1.9
- scraping-master@0.1.8
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.