@coralxyz/anchor

GHSA-hhj6-h3rr-qc2j

Malicious code in @coralxyz/anchor (npm)

Details

**Severity:** Critical

**Affected versions:** `= 0.30.2`

## Source: amazon-inspector (1475ce579e5b1ce9d7597187d091b29b70cbe1a563ed70946517673c29683763)
Package @coralxyz/anchor impersonates the legitimate Solana Anchor framework package @coral-xyz/anchor (hyphen removed). The npm postinstall hook, implemented in scripts/postinstall.js, hides all string literals behind a hex-escaped string-array decoder (_0x5a2f / _0xf). On Windows (win32), the decoded logic downloads a zip archive from the anonymous file host https://files.catbox.moe/9bppy2.zip, extracts it via PowerShell Expand-Archive to a temporary directory, walks the extracted tree, and spawns any.exe file it finds detached with windowsHide. index.js is a minimal stub; the package's advertised Anchor framework functionality is not present, and the postinstall dropper is the sole meaningful behavior. The delivery vector is name confusion with the widely used @coral-xyz/anchor package.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/f4865d38bdd8cf89a75895cd20168baaaa03aea4/osv/malicious/npm/@coralxyz/anchor/MAL-2026-13629.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/f4865d38bdd8cf89a75895cd20168baaaa03aea4/osv/malicious/npm/@coralxyz/anchor/MAL-2026-13629.json
- https://www.npmjs.com/package/@coralxyz/anchor/v/0.30.2
- https://github.com/advisories/GHSA-hhj6-h3rr-qc2j

Compromised versions (1)

= 0.30.2

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.