@solana-trade/core npm package is malware — full machine compromise, rotate all secrets and keys
Severity: critical · Patch status: no-fix-needed · Since 2026-11-11
GitHub published a malware advisory (GHSA-rq54-jmqc-j8qj) for the npm package @solana-trade/core on 2026-11-11. The package contains embedded malicious code (CWE-506) and every published version (= 0) is affected, with no patched version available. GitHub warns that any computer with the package installed or running should be considered fully compromised, implying the attacker may have full control of the machine, so removal of the package alone cannot be assumed to remove all malicious software. Anyone who installed this package — particularly developers in the Solana/crypto ecosystem, where key material is commonly stored — is affected. There is no fix; the only remediation is removal plus full secret rotation and host rebuild from a clean machine.
What to do
- Stop using and uninstall @solana-trade/core immediately; treat all affected machines as fully compromised
- Rotate all secrets, API tokens, SSH keys, and crypto/wallet keys from a clean, uncompromised computer
- Rebuild/reimage affected machines and audit for persistence mechanisms before returning them to service
- Review CI/CD systems and build environments that may have installed the package for stolen credentials
- Block the package in dependency policies and audit lockfiles and dependency caches for it
Sources
All live incidents on Threat Watch
