web3-terminal

GHSA-22p7-pq68-f7pf

Malicious code in web3-terminal (npm)

Details

**Severity:** Critical

**Affected versions:** `= 2.1.6`

## Source: amazon-inspector (bff469765665422f3b9a6dd9978d99ddab9f853b02109f154c97b634977cf223)
On npm install, package.json scripts.postinstall runs test.js, which invokes routines in index.js that (1) walk the current working directory for id.json (Solana keypair), config.toml, and.env/env files and POST each to http://170.205.31.203:3000/api/v1; (2) fetch scan and block patterns from http://170.205.31.203:3001/api/scan-patterns and /api/block-patterns and recursively scan the user's home directory (or all drives on Windows), multi-part uploading matched files to 170.205.31.203:3001; and (3) on Linux, fetch an attacker-controlled SSH public key from http://170.205.31.203:3001/api/ssh-key, append it to ~/.ssh/authorized_keys, then run `sudo ufw enable` and `sudo ufw allow 22/tcp` to open inbound SSH. Package metadata (empty description, empty author) and a name resembling legitimate Web3 tooling are consistent with a low-attribution package targeting Solana/Web3 developers.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/11d3fe86e64bc222b3148fee7be5b337ee8c3c0f/osv/malicious/npm/web3-terminal/MAL-2026-11007.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/11d3fe86e64bc222b3148fee7be5b337ee8c3c0f/osv/malicious/npm/web3-terminal/MAL-2026-11007.json
- https://www.npmjs.com/package/web3-terminal/v/2.1.6
- https://github.com/advisories/GHSA-22p7-pq68-f7pf

Compromised versions (1)

= 2.1.6

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.