OpenSSF/OSV advisory MAL-2026-12101 confirms this npm version as malicious. On require(), index.js JSON-encodes the full process.env plus hostname, username, homedir, platform, cwd, and package metadata, base64-encodes the payload, and sends it as a Telegram Bot API sendMessage GET request to a hardcoded bot token and chat_id (8969499041). A marker file in the OS tmpdir gates the beacon to fire once per host...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in @wethenorth12/solana-wallet-adapter (npm)
Details
On require(), index.js JSON-encodes the full process.env plus hostname, username, homedir, platform, cwd, and package metadata, base64-encodes the payload, and sends it as a Telegram Bot API sendMessage GET request to a hardcoded bot token and chat_id (8969499041). A marker file in the OS tmpdir gates the beacon to fire once per host. The package impersonates @solana/wallet-adapter-base: the author field is spoofed as 'anza-xyz', the README advertises a 'drop-in replacement', and the module attempts to require the real @solana/wallet-adapter-base and re-export it so consumers see a working facade while the exfiltration runs silently. Developer and CI environments routinely carry AWS_*, GITHUB_TOKEN, NPM_TOKEN, and other credential-shaped variables, so a full env dump to an attacker endpoint is credential theft against the installer.
Decision reason
OpenSSF Malicious Packages via OSV confirms @wethenorth12/solana-wallet-adapter@0.18.0 as malicious (MAL-2026-12101): Malicious code in @wethenorth12/solana-wallet-adapter (npm)