solana-mev-bot@1.0.0
Vulnerability report · Last retrieved from osv.dev September 6, 2026 at 6:01 AM UTC
OSV ID
MAL-2026-5861
Ecosystem
npm
Summary
bot.js performs a hardcoded HTTPS GET to api.telegram.org's bot sendMessage endpoint, transmitting host fingerprint data collected via os.hostname(), os.userInfo(), and process.platform. The file also imports child_process and reads from the filesystem (fs.existsSync / fs.readFileSync) alongside the network exfiltration primitive. The destination is an attacker-operated Telegram bot, used as an exfiltration channel to siphon installer host identity and likely credential/wallet material from disk. The package name impersonates a Solana MEV trading utility to lure crypto users into running it.
Source: amazon-inspector (e65516d3e042858742ebfee878ff2de6361994ce0155dcbf53c8e0f24cd5fafb)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.