Skip to content

Malware in @solana/web3.js

Malware Published Dec 3, 2024 to the GitHub Advisory Database • Updated Dec 4, 2024

Package

npm @solana/web3.js (npm)

Affected versions

>= 1.95.6, < 1.95.8

Patched versions

1.95.8

Description

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

References

Published to the GitHub Advisory Database Dec 3, 2024
Reviewed Dec 3, 2024
Last updated Dec 4, 2024

Weaknesses

GHSA ID

GHSA-2mhj-xmf4-pr8m
Improvements are not currently accepted on this advisory because this package is malware and has no patched versions. If there is something to change, please open an issue at https://github.com/github/advisory-database/issues.