sol-wallet-adapater (npm): malicious package compromises machines and exposes all stored secrets and keys (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-11-13
The GitHub Advisory Database published GHSA-5c87-58w4-f8xf on 2026-11-13 flagging the npm package sol-wallet-adapater (note the misspelling of 'adapter') as malware, affecting all versions (= 0) with no patched version available. The advisory states any computer with the package installed or running should be considered fully compromised, with full control potentially given to an outside entity. All secrets and keys stored on affected machines should be rotated immediately from a different computer. The package appears to be a typosquat-style malicious package with no known source code. Removal of the package does not guarantee removal of all malicious software it may have installed. CWE-506 (Embedded Malicious Code) is cited.
What to do
- Treat any machine with sol-wallet-adapater installed as fully compromised
- Rotate all secrets and keys stored on affected machines immediately, from a clean computer
- Remove the package and rebuild/reimage affected machines, as removal may not eliminate all malicious software
- Audit dependency trees and lockfiles for the package and block it in CI/CD and registry proxies
Sources
All live incidents on Threat Watch
