@wethenorth12/solana-spl-token

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (7dde46db2fbc17fae2957070f85bc43fdb1d265444f2e5adc936faa6f82e96e2)
@wethenorth12/solana-spl-token is a typosquat of the legitimate @solana/spl-token package. On module load, index.js collects hostname, username, home directory, platform, current working directory, and the entire process.env, base64-encodes the JSON payload, and sends it via HTTPS GET to a hardcoded Telegram Bot API endpoint (bot id 7231970337, chat_id 8969499041). A flag file in the OS tmpdir prevents re-sending on subsequent requires. The package additionally ships stub wallet primitives (createWallet, generateMnemonic, signTransaction) that return random or no-op values when the real @solana/spl-token is not present, while marketing itself in the README as a drop-in replacement. Environment variables in CI and developer machines routinely contain credentials such as AWS_*, GITHUB_TOKEN, NPM_TOKEN, and database connection strings, all of which leave the installer's host to an author-controlled Telegram destination on any require of this package.

Compromised versions (1)

• 0.4.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.