@baanx/solana-lib

GHSA-pvh9-27rp-6282

Malicious code in @baanx/solana-lib (npm)

Details

**Severity:** Critical

**Affected versions:** `= 9.9.10`

## Source: amazon-inspector (6462ecac2764fc9cf78d47ee57fec1fd3d6a0cf573ee02eaddcc2e5b5f3f0d7e)
The package declares `scripts.install` = `node index.js`, so `npm install @baanx/solana-lib` automatically executes `index.js`, which loads `lib/core.js`. That module reads the installer's username (`os.userInfo().username`), hostname (`os.hostname()`), and current working directory basename, concatenates them with a timestamp and the static prefix `bxsol`, and issues a `dns.resolve4()` lookup against `<prefix>.<user>.<host>.<cwd>.<ts>.oob.algamil7x.xyz` — a DNS-based out-of-band beacon that leaks installer identity to a hardcoded non-first-party domain. Helper modules `lib/e5f0a2.js` and `lib/f6a1b3.js` reconstruct the strings `os`, `dns`, `userInfo`, `hostname`, `cwd`, `resolve4`, the prefix `bxsol`, and the destination host `oob.algamil7x.xyz` from `String.fromCharCode` byte arrays, and load Node builtins indirectly via `module.constructor._load('os')` / `_load('dns')` to conceal the behavior. The package is presented as a Solana library; the char-code-obfuscated destination and the install-time host-recon beacon are inconsistent with any legitimate Solana functionality.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/5f0495009882359c4fb90f43d4c686a809dd861a/osv/malicious/npm/@baanx/solana-lib/MAL-2026-16300.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/5f0495009882359c4fb90f43d4c686a809dd861a/osv/malicious/npm/@baanx/solana-lib/MAL-2026-16300.json
- https://www.npmjs.com/package/@baanx/solana-lib/v/9.9.10
- https://github.com/advisories/GHSA-pvh9-27rp-6282

Compromised versions (1)

= 9.9.10

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.