@wethenorth12/solana-wallet-adapter @0.18.0
Vulnerability report · Last retrieved from osv.dev August 5, 2026 at 5:03 PM UTC
OSV ID
MAL-2026-12101
Ecosystem
npm
Summary
On require(), index.js JSON-encodes the full process.env plus hostname, username, homedir, platform, cwd, and package metadata, base64-encodes the payload, and sends it as a Telegram Bot API sendMessage GET request to a hardcoded bot token and chat_id (8969499041). A marker file in the OS tmpdir gates the beacon to fire once per host. The package impersonates @solana/wallet-adapter-base: the author field is spoofed as 'anza-xyz', the README advertises a 'drop-in replacement', and the module attempts to require the real @solana/wallet-adapter-base and re-export it so consumers see a working facade while the exfiltration runs silently. Developer and CI environments routinely carry AWS_*, GITHUB_TOKEN, NPM_TOKEN, and other credential-shaped variables, so a full env dump to an attacker endpoint is credential theft against the installer.
Source: amazon-inspector (14e7d05f22a60d86ce4aea030108a6f50a69b85ce9bb0219eb59fbe2dbc3bbb2)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.