MAL-2026-13629
Malicious code in @coralxyz/anchor (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (1475ce579e5b1ce9d7597187d091b29b70cbe1a563ed70946517673c29683763) Package @coralxyz/anchor impersonates the legitimate Solana Anchor framework package @coral-xyz/anchor (hyphen removed). The npm postinstall hook, implemented in scripts/postinstall.js, hides all string literals behind a hex-escaped string-array decoder (_0x5a2f / _0xf). On Windows (win32), the decoded logic downloads a zip archive from the anonymous file host https://files.catbox.moe/9bppy2.zip, extracts it via PowerShell Expand-Archive to a temporary directory, walks the extracted tree, and spawns any.exe file it finds detached with windowsHide. index.js is a minimal stub; the package's advertised Anchor framework functionality is not present, and the postinstall dropper is the sole meaningful behavior. The delivery vector is name confusion with the widely used @coral-xyz/anchor package.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for @coralxyz/anchor (npm). Pin to a known-safe version or switch to an alternative.