registry / @baanx/solana-lib / 9.9.10

@baanx/solana-lib@9.9.10

Solana blockchain service integration library

AI Security Review

scanned 17d ago · by lpm-firewall-ai

An automatic install hook invokes concealed code that transmits host-identifying data by DNS. No user action beyond package installation is required.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm installation runs the install script.

Impact

The package covertly exposes installation and host metadata to an external operator.

Mechanism

index.js loads lib/core.js, which obtains a username, hostname, and current-directory name and encodes them as DNS labels for a decoded external domain.

Attack narrative

During installation, the package loads hidden telemetry code. It gathers the local username, hostname, and current directory name, constructs a DNS name with those values and a timestamp, and resolves it under oob.almagil7x.xyz. The imports and destination are intentionally obscured with character-code decoding and errors are suppressed.

AI rationale

This is concealed, automatic host-data exfiltration through DNS during installation, unrelated to the stated Solana library function. The behavior is concrete malicious install-time data exfiltration.

Evidence

package.jsonindex.jslib/core.jslib/e5f0a2.jslib/f6a1b3.js

Network endpoints1

oob.almagil7x.xyz

OSV advisory

OpenSSF/OSV

The package declares `scripts.install` = `node index.js`, so `npm install @baanx/solana-lib` automatically executes `index.js`, which loads `lib/core.js`. That module reads the installer's username (`os.userInfo().username`), hostname (`os.hostname()`), and current working directory basename, concatenates them with a timestamp and the static prefix `bxsol`, and issues a `dns.resolve4()` lookup against `<prefix>.<user>.<host>.<cwd>.<ts>.oob.algamil7x.xyz` — a DNS-based out-of-band beacon that leaks installer identity to a hardcoded non-first-party domain. Helper modules `lib/e5f0a2.js` and `lib/f6a1b3.js` reconstruct the strings `os`, `dns`, `userInfo`, `hostname`, `cwd`, `resolve4`, the prefix `bxsol`, and the destination host `oob.algamil7x.xyz` from `String.fromCharCode` byte arrays, and load Node builtins indirectly via `module.constructor._load('os')` / `_load('dns')` to conceal the behavior. The package is presented as a Solana library; the char-code-obfuscated destination and the install-time host-recon beacon are inconsistent with any legitimate Solana functionality. ## Source: ghsa-malware (ae13a6ad6865a2910cfb51f6e69cfa625450b6e017c846e702cc216e69cb0abe) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

@baanx/solana-lib@9.9.10

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code