MAL-2026-10904

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (073f4c1e75630bbf1c535a334f4d7f233a73439240bc22e69bac0e926c8c58a0) Package name closely mirrors the widely-used @solana/web3.js Solana SDK while being published under an unrelated, unscoped name. The bundled lib/index.cjs.js and lib/index.esm.js contain co-occurring patterns of require('child_process'), fetch/POST/GET calls, and shell utilities (curl, ping) within the same minified bundle. Without traced execution, it cannot be confirmed from these matches alone whether the network calls are user-facing RPC client functionality (consistent with a Solana SDK) or a hardcoded exfiltration channel, nor whether the child_process/curl/ping usage is dead/library code or reachable on import. Given the strong name-confusion against a high-traffic SDK target, the combination of HTTP + child_process + shell-tool keywords inside a single bundle, and the lack of clean traced evidence, this should not be auto-allowed; a human should verify the destinations, the reachability of the child_process paths, and whether the package is a legitimate fork/mirror or a confusion-attack lure.