🛡️ MAL-2026-4247 — solana-pda-helper

Malicious code in solana-pda-helper (npm)

Source: amazon-inspector

On npm install, package.json's postinstall hook runs node -e to issue an https.get against rqnyz-2605-7280-7--2000-c51.run.pinggy-free.link/npm/-/binary/telemetry — a Pinggy free-tier reverse-tunnel subdomain, which is the ephemeral attacker-callback host class, not legitimate telemetry infrastructure. The request is wrapped in try/catch to silently swallow errors, and even a failed request leaks installer IP, hostname resolution, and install timing to attacker infrastructure; the same hook is a standard staging point for follow-on payload delivery. The package compounds this with namespace-abuse signals: it advertises itself as 'Automatic PDA derivation for Anchor programs' but index.js is a 139-byte stub that only console.logs and shells out to solana --version, implementing none of the advertised functionality; the repository field points at github.com/solana/solana-pda-helper, impersonating the Solana org, which does not own this package; and keywords include 'ethereum' for a Solana-branded package. The combination of org-impersonation, hollow implementation, and install-time beacon to an ephemeral tunnel is a deliberate supply-chain attack lure rather than a misconfigured package.

Source: ghsa-malware

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.