@gabrielhicks/solv@5.8.37: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

@gabrielhicks/solv@5.8.37: Malicious npm security report (Block) | LPM Firewall

AI called this Malicious at 97.0% confidence as Malware with low false-positive risk.

Evidence for block

dist/index.js source map: `scp upload --vs` fetches verify.validators.solutions then shell-executes every returned command.
Remote commands run with `shell: true` and `stdio: ignore`, with no validation or user display.
The same CLI handles validator keypair upload/export, making its remote execution path high impact.

Evidence against

package.json has no preinstall, install, or postinstall hook.
The remote-command path requires explicit `solv scp upload --vs` selection.

Behavioral surface

Source

EnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 572 KB of source, external domains: 127.0.0.1, amsterdam.mainnet.bam.jito.wtf, amsterdam.mainnet.block-engine.jito.wtf, amsterdam.mainnet.relayer.jito.wtf, api.mainnet-beta.solana.com, api.testnet.solana.com, dallas.testnet.bam.jito.wtf, dallas.testnet.block-engine.jito.wtf, dallas.testnet.relayer.jito.wtf, discord.gg, dl.cloudsmith.io, dublin.mainnet.bam.jito.wtf, dublin.mainnet.block-engine.jito.wtf, dublin.mainnet.relayer.jito.wtf, frankfurt.mainnet.bam.jito.wtf, frankfurt.mainnet.block-engine.jito.wtf, frankfurt.mainnet.relayer.jito.wtf, github.com, influx.thevalidators.io, influxdb.apps.ra.latentfree.llc, jup.validators.solutions, london.mainnet.bam.jito.wtf, london.mainnet.block-engine.jito.wtf, london.mainnet.relayer.jito.wtf, mainnet-beta.solana.com, metrics.jito.wtf, metrics.solana.com, ny.mainnet.bam.jito.wtf, ny.mainnet.block-engine.jito.wtf, ny.mainnet.relayer.jito.wtf, ny.testnet.bam.jito.wtf, ny.testnet.block-engine.jito.wtf, ny.testnet.relayer.jito.wtf, quote-api.jup.ag, raw.githubusercontent.com, registry.npmjs.org, repos.influxdata.com, singapore.mainnet.bam.jito.wtf, singapore.mainnet.block-engine.jito.wtf, singapore.mainnet.relayer.jito.wtf, slc.mainnet.bam.jito.wtf, slc.mainnet.block-engine.jito.wtf, slc.mainnet.relayer.jito.wtf, slc.testnet.bam.jito.wtf, snapshots.avorio.network, solana.thevalidators.io, solanacompass.com, solscan.io, tokyo.mainnet.bam.jito.wtf, tokyo.mainnet.block-engine.jito.wtf

Source & flagged code

9 flagged · loading source

dist/index.jsView file

1#!/usr/bin/env node L2: var uT=Object.defineProperty;var E=(_,e)=>uT(_,"name",{value:e,configurable:!0}),pT=(_=>typeof require<"u"?require:typeof Proxy<"u"?new Proxy(_,{get:(e,t)=>(typeof require<"u"?requ... L3: Please set DISCORD_WEBHOOK_URL in .env`);let t={content:_,username:"\u{1FA84} Solv Notifier"};return(await ea(e.DISCORD_WEBHOOK_URL,{method:"POST",body:JSON.stringify(t),headers:{"...

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/index.jsView on unpkg · L1

1#!/usr/bin/env node L2: var uT=Object.defineProperty;var E=(_,e)=>uT(_,"name",{value:e,configurable:!0}),pT=(_=>typeof require<"u"?require:typeof Proxy<"u"?new Proxy(_,{get:(e,t)=>(typeof require<"u"?requ... L3: Please set DISCORD_WEBHOOK_URL in .env`);let t={content:_,username:"\u{1FA84} Solv Notifier"};return(await ea(e.DISCORD_WEBHOOK_URL,{method:"POST",body:JSON.stringify(t),headers:{"... L4: Account: ${s.pubkey} ... L5797: at the NOTICE level to the logger. E.g. for a typical fd_log L5798: `;return{filePath:_,body:e}},"modDiff"),vt=ha;var Ht=E(async(_,e,t=!1)=>{let o=_.NETWORK===O.TESTNET,i=e||(o?le:w_),n=t||_.MOD,{filePath:s,body:r}=vt();n?(H("git -C /home/solv/fire... L5799: exec agave-validator \\ ... L6155: L6156: $ solv jupiter --help`))},"jupiterAPISetup"),En=DS;import{spa

Critical

Wallet Drain

Source uses private key material to transfer cryptocurrency funds.

dist/index.jsView on unpkg · L1

1Trigger-reachable chain: manifest.main -> dist/index.js L1: #!/usr/bin/env node L2: var uT=Object.defineProperty;var E=(_,e)=>uT(_,"name",{value:e,configurable:!0}),pT=(_=>typeof require<"u"?require:typeof Proxy<"u"?new Proxy(_,{get:(e,t)=>(typeof require<"u"?requ... L3: Please set DISCORD_WEBHOOK_URL in .env`);let t={content:_,username:"\u{1FA84} Solv Notifier"};return(await ea(e.DISCORD_WEBHOOK_URL,{method:"POST",body:JSON.stringify(t),headers:{"... L4: Account: ${s.pubkey}

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L1

1#!/usr/bin/env node L2: var uT=Object.defineProperty;var E=(_,e)=>uT(_,"name",{value:e,configurable:!0}),pT=(_=>typeof require<"u"?require:typeof Proxy<"u"?new Proxy(_,{get:(e,t)=>(typeof require<"u"?requ... L3: Please set DISCORD_WEBHOOK_URL in .env`);let t={content:_,username:"\u{1FA84} Solv Notifier"};return(await ea(e.DISCORD_WEBHOOK_URL,{method:"POST",body:JSON.stringify(t),headers:{"... L4: Account: ${s.pubkey}

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L1

1#!/usr/bin/env node L2: var uT=Object.defineProperty;var E=(_,e)=>uT(_,"name",{value:e,configurable:!0}),pT=(_=>typeof require<"u"?require:typeof Proxy<"u"?new Proxy(_,{get:(e,t)=>(typeof require<"u"?requ... L3: Please set DISCORD_WEBHOOK_URL in .env`);let t={content:_,username:"\u{1FA84} Solv Notifier"};return(await ea(e.DISCORD_WEBHOOK_URL,{method:"POST",body:JSON.stringify(t),headers:{"... L4: Account: ${s.pubkey} ... L5797: at the NOTICE level to the logger. E.g. for a typical fd_log L5798: `;return{filePath:_,body:e}},"modDiff"),vt=ha;var Ht=E(async(_,e,t=!1)=>{let o=_.NETWORK===O.TESTNET,i=e||(o?le:w_),n=t||_.MOD,{filePath:s,body:r}=vt();n?(H("git -C /home/solv/fire... L5799: exec agave-validator \\ ... L6155: L6156: $ solv jupiter --help`))},"jupiterAPISetup"),En=DS;import{spa

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L1

6797patternName = generic_password severity = medium line = 6797 matchedText = password...b3c"

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/index.jsView on unpkg · L6797

1#!/usr/bin/env node L2: var uT=Object.defineProperty;var E=(_,e)=>uT(_,"name",{value:e,configurable:!0}),pT=(_=>typeof require<"u"?require:typeof Proxy<"u"?new Proxy(_,{get:(e,t)=>(typeof require<"u"?requ... L3: Please set DISCORD_WEBHOOK_URL in .env`);let t={content:_,username:"\u{1FA84} Solv Notifier"};return(await ea(e.DISCORD_WEBHOOK_URL,{method:"POST",body:JSON.stringify(t),headers:{"... L4: Account: ${s.pubkey} ... L5797: at the NOTICE level to the logger. E.g. for a typical fd_log L5798: `;return{filePath:_,body:e}},"modDiff"),vt=ha;var Ht=E(async(_,e,t=!1)=>{let o=_.NETWORK===O.TESTNET,i=e||(o?le:w_),n=t||_.MOD,{filePath:s,body:r}=vt();n?(H("git -C /home/solv/fire... L5799: exec agave-validator \\ ... L6155: L6156: $ solv jupiter --help`))},"jupiterAPISetup"),En=DS;import{spa

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/index.jsView on unpkg · L1

6824patternName = generic_password severity = medium line = 6824 matchedText = `;if(jR(...en(`

Medium

Secret Pattern

Hardcoded password in dist/index.js

dist/index.jsView on unpkg · L6824

dist/cli/monitoring/scripts/output_validator_measurements.pyView file

•path = dist/cli/monitoring/scripts/output_validator_measurements.py kind = build_helper sizeBytes = 172 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/cli/monitoring/scripts/output_validator_measurements.pyView on unpkg

Source & flagged code

9 flagged

dist/index.jsView file

1#!/usr/bin/env node L2: var uT=Object.defineProperty;var E=(_,e)=>uT(_,"name",{value:e,configurable:!0}),pT=(_=>typeof require<"u"?require:typeof Proxy<"u"?new Proxy(_,{get:(e,t)=>(typeof require<"u"?requ... L3: Please set DISCORD_WEBHOOK_URL in .env`);let t={content:_,username:"\u{1FA84} Solv Notifier"};return(await ea(e.DISCORD_WEBHOOK_URL,{method:"POST",body:JSON.stringify(t),headers:{"...

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/index.jsView on unpkg · L1

1#!/usr/bin/env node L2: var uT=Object.defineProperty;var E=(_,e)=>uT(_,"name",{value:e,configurable:!0}),pT=(_=>typeof require<"u"?require:typeof Proxy<"u"?new Proxy(_,{get:(e,t)=>(typeof require<"u"?requ... L3: Please set DISCORD_WEBHOOK_URL in .env`);let t={content:_,username:"\u{1FA84} Solv Notifier"};return(await ea(e.DISCORD_WEBHOOK_URL,{method:"POST",body:JSON.stringify(t),headers:{"... L4: Account: ${s.pubkey} ... L5797: at the NOTICE level to the logger. E.g. for a typical fd_log L5798: `;return{filePath:_,body:e}},"modDiff"),vt=ha;var Ht=E(async(_,e,t=!1)=>{let o=_.NETWORK===O.TESTNET,i=e||(o?le:w_),n=t||_.MOD,{filePath:s,body:r}=vt();n?(H("git -C /home/solv/fire... L5799: exec agave-validator \\ ... L6155: L6156: $ solv jupiter --help`))},"jupiterAPISetup"),En=DS;import{spa

Critical

Wallet Drain

Source uses private key material to transfer cryptocurrency funds.

dist/index.jsView on unpkg · L1

1Trigger-reachable chain: manifest.main -> dist/index.js L1: #!/usr/bin/env node L2: var uT=Object.defineProperty;var E=(_,e)=>uT(_,"name",{value:e,configurable:!0}),pT=(_=>typeof require<"u"?require:typeof Proxy<"u"?new Proxy(_,{get:(e,t)=>(typeof require<"u"?requ... L3: Please set DISCORD_WEBHOOK_URL in .env`);let t={content:_,username:"\u{1FA84} Solv Notifier"};return(await ea(e.DISCORD_WEBHOOK_URL,{method:"POST",body:JSON.stringify(t),headers:{"... L4: Account: ${s.pubkey}

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L1

1#!/usr/bin/env node L2: var uT=Object.defineProperty;var E=(_,e)=>uT(_,"name",{value:e,configurable:!0}),pT=(_=>typeof require<"u"?require:typeof Proxy<"u"?new Proxy(_,{get:(e,t)=>(typeof require<"u"?requ... L3: Please set DISCORD_WEBHOOK_URL in .env`);let t={content:_,username:"\u{1FA84} Solv Notifier"};return(await ea(e.DISCORD_WEBHOOK_URL,{method:"POST",body:JSON.stringify(t),headers:{"... L4: Account: ${s.pubkey}

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L1

1#!/usr/bin/env node L2: var uT=Object.defineProperty;var E=(_,e)=>uT(_,"name",{value:e,configurable:!0}),pT=(_=>typeof require<"u"?require:typeof Proxy<"u"?new Proxy(_,{get:(e,t)=>(typeof require<"u"?requ... L3: Please set DISCORD_WEBHOOK_URL in .env`);let t={content:_,username:"\u{1FA84} Solv Notifier"};return(await ea(e.DISCORD_WEBHOOK_URL,{method:"POST",body:JSON.stringify(t),headers:{"... L4: Account: ${s.pubkey} ... L5797: at the NOTICE level to the logger. E.g. for a typical fd_log L5798: `;return{filePath:_,body:e}},"modDiff"),vt=ha;var Ht=E(async(_,e,t=!1)=>{let o=_.NETWORK===O.TESTNET,i=e||(o?le:w_),n=t||_.MOD,{filePath:s,body:r}=vt();n?(H("git -C /home/solv/fire... L5799: exec agave-validator \\ ... L6155: L6156: $ solv jupiter --help`))},"jupiterAPISetup"),En=DS;import{spa

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L1

6797patternName = generic_password severity = medium line = 6797 matchedText = password...b3c"

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/index.jsView on unpkg · L6797

1#!/usr/bin/env node L2: var uT=Object.defineProperty;var E=(_,e)=>uT(_,"name",{value:e,configurable:!0}),pT=(_=>typeof require<"u"?require:typeof Proxy<"u"?new Proxy(_,{get:(e,t)=>(typeof require<"u"?requ... L3: Please set DISCORD_WEBHOOK_URL in .env`);let t={content:_,username:"\u{1FA84} Solv Notifier"};return(await ea(e.DISCORD_WEBHOOK_URL,{method:"POST",body:JSON.stringify(t),headers:{"... L4: Account: ${s.pubkey} ... L5797: at the NOTICE level to the logger. E.g. for a typical fd_log L5798: `;return{filePath:_,body:e}},"modDiff"),vt=ha;var Ht=E(async(_,e,t=!1)=>{let o=_.NETWORK===O.TESTNET,i=e||(o?le:w_),n=t||_.MOD,{filePath:s,body:r}=vt();n?(H("git -C /home/solv/fire... L5799: exec agave-validator \\ ... L6155: L6156: $ solv jupiter --help`))},"jupiterAPISetup"),En=DS;import{spa

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/index.jsView on unpkg · L1

6824patternName = generic_password severity = medium line = 6824 matchedText = `;if(jR(...en(`

Medium

Secret Pattern

Hardcoded password in dist/index.js

dist/index.jsView on unpkg · L6824

dist/cli/monitoring/scripts/output_validator_measurements.pyView file

•path = dist/cli/monitoring/scripts/output_validator_measurements.py kind = build_helper sizeBytes = 172 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/cli/monitoring/scripts/output_validator_measurements.pyView on unpkg