Malicious Code Vulnerability in solana-sdkpy: A Threat to PyPI Users
Summary
MAL-2025-6588: Malicious code in solana-sdkpy (PyPI). Affects solana-sdkpy versions 1.2.2 – 1.2.6. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
solana-sdkpy is a Python library designed for interacting with the Solana blockchain, providing developers with tools to build decentralized applications. It offers functionalities such as transaction handling, account management, and interaction with smart contracts. However, certain versions of this package have been identified to contain malicious code, posing a significant risk to users who rely on its integrity.
Vulnerability Detail
The vulnerability originates from malicious code embedded in specific versions of the solana-sdkpy package (1.2.2, 1.2.3, 1.2.5, 1.2.6). This code can potentially compromise user systems, leading to unauthorized access, data breaches, or other malicious activities. The affected versions were sourced from ReversingLabs, which identified the issue and provided details on the impacted releases.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall solana-sdkpyIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, users can avoid using the affected versions of solana-sdkpy by specifying a version that is known to be safe in their requirements file or Pipfile. For example, you can specify: 'solana-sdkpy>=1.2.7' to ensure you are using a secure version.
Conclusion
The solana-sdkpy package has been identified to contain malicious code in specific versions, posing a significant risk to users. It is crucial to update to a secure version to mitigate potential threats. Users can also utilize tools like Vulert to monitor for vulnerabilities in their applications.
See every vulnerability recorded for solana-sdkpy →
FAQ
The affected versions are 1.2.2, 1.2.3, 1.2.5, and 1.2.6.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
As a workaround, avoid using the affected versions and specify a safe version in your requirements file.
The vulnerability was discovered by ReversingLabs, a cybersecurity firm specializing in threat detection.
Using the affected versions may lead to unauthorized access to your system, data breaches, or other malicious activities.
