@solana-common/utils npm package is malware — full machine compromise, no patched versions (GHSA-r533-jgcg-qr68)
Severity: critical · Patch status: no-fix-needed · Since 2026-11-10
GitHub published a malware advisory (GHSA-r533-jgcg-qr68) on 2026-11-10 for the npm package @solana-common/utils, flagging versions 1.0.0 through 2.0.12 as containing embedded malicious code (CWE-506). The advisory states any computer with the package installed or running should be considered fully compromised, with attackers potentially gaining full control of the machine. No patched versions exist and no source code is known; the package has no legitimate upstream. Exposure is limited (69 downloads/month, 2757 GitHub stars cited in the advisory metadata), but anyone who installed any listed version should treat secrets and keys on that machine as stolen. Removal of the package alone does not guarantee remediation, since malware may persist. Affected users must rotate all credentials from a clean machine and rebuild compromised hosts.
What to do
- Treat any machine with @solana-common/utils installed as fully compromised; rotate all secrets, keys, and credentials immediately from a clean machine
- Remove the package and rebuild/reimage affected systems rather than attempting in-place cleanup
- Audit dependency lockfiles and CI caches for the package and any versions 1.0.0–2.0.12
- Review access logs and wallet/crypto activity for signs of exfiltration
- Block the package in internal registries and proxy policies
Sources
All live incidents on Threat Watch
