🛡️ MAL-2026-12100 — solana-spl-token

Malicious code in @wethenorth12/solana-spl-token (npm)

Source: amazon-inspector

@wethenorth12/solana-spl-token is a typosquat of the legitimate @solana/spl-token package. On module load, index.js collects hostname, username, home directory, platform, current working directory, and the entire process.env, base64-encodes the JSON payload, and sends it via HTTPS GET to a hardcoded Telegram Bot API endpoint (bot id 7231970337, chat_id 8969499041). A flag file in the OS tmpdir prevents re-sending on subsequent requires. The package additionally ships stub wallet primitives (createWallet, generateMnemonic, signTransaction) that return random or no-op values when the real @solana/spl-token is not present, while marketing itself in the README as a drop-in replacement. Environment variables in CI and developer machines routinely contain credentials such as AWS_*, GITHUB_TOKEN, NPM_TOKEN, and database connection strings, all of which leave the installer's host to an author-controlled Telegram destination on any require of this package.