Malicious Code Detected in solana-spl-sdk: Version 0.1.1 Compromised
Summary
MAL-2025-6886: Malicious code in solana-spl-sdk (npm). Affects solana-spl-sdk versions 0.1.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The solana-spl-sdk is a JavaScript library designed for interacting with the Solana blockchain, providing developers with tools to build decentralized applications. This package is widely used in the Solana ecosystem for its functionality in managing tokens and transactions. However, version 0.1.1 has been identified as malicious, posing significant security risks to users and applications relying on it.
Vulnerability Detail
The vulnerability stems from the malicious behavior embedded within the solana-spl-sdk package version 0.1.1. This version executes commands that can lead to unauthorized access or manipulation of user data. The OpenSSF Package Analysis project flagged this package as malicious due to its potential to compromise the integrity of applications using it, making it a critical concern for developers and users alike.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall solana-spl-sdkIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the malicious package from your project by executing the following command: npm uninstall solana-spl-sdk. This will prevent any malicious code from executing until a safe version is available.
Conclusion
The solana-spl-sdk version 0.1.1 has been flagged as malicious, posing significant risks to applications utilizing it. Developers are urged to update to the latest version to safeguard their projects. Monitoring tools like Vulert can assist in identifying vulnerabilities without requiring extensive setup.
See every vulnerability recorded for solana-spl-sdk →
FAQ
The solana-spl-sdk is a JavaScript library that facilitates interaction with the Solana blockchain, allowing developers to manage tokens and transactions.
The malicious behavior was identified by the OpenSSF Package Analysis project, which flagged version 0.1.1 for executing commands associated with malicious activities.
You should immediately update to the latest version of the package to mitigate any security risks associated with the malicious code.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just package-lock.json. You can check your application for vulnerabilities using the Vulert playground at Vulert Scanner.
Using a compromised package can lead to unauthorized access to sensitive data, manipulation of application behavior, and potential breaches of user trust.
