LWA-2026-5173 confirmed malware
solanarpclampweb3@1.0.3
Malicious code in solanarpclampweb3 (npm)
T1195.002 · Compromise Software Supply ChainT1552.001 · Credentials In FilesT1041 · Exfiltration Over C2 ChannelT1071.001 · Web Protocols
Analysis
solanarpclampweb3 exports a function designed to accept a wallet private key as an argument and exfiltrate it to a Telegram bot. The function constructs a POST request to api[.]telegram[.]org using a hardcoded bot token, sending the private key as a text message to a hardcoded Telegram chat ID. The package name mimics a Solana/Web3 RPC utility to trick users into importing it and passing their private key, which is then exfiltrated via Telegram's API.
- analyzed by
- Leitwacht
- first seen
- Jun 14, 2026, 02:32 AM
- analyzed
- Jun 14, 2026, 02:34 AM
Related advisories
- sjs-builders@1.0.4
- sickle-wrapper@0.2.0
- self-v8@8.3.9
- seed-to-private@1.0.1
- scoin_setting@1.0.18
- saps_secplayground_npm_ai@1.0.4
- rimo-env-validator@1.0.1
- houzidawang807@1.1.6
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.