Skip to content
OpenAdvisories

Package · npm

@solana/web3.js

2 known vulnerabilities.

Malicious versions reported for this package

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • High 8.3
    CVE-2024-54134

    @solana/web3.js modified package published to npm, containing malware that exfiltrates private key material

    A publish-access account was compromised for `@solana/web3.js`, a JavaScript library that is commonly used by Solana dapps. This allowed an attacker to publish unauthorized and malicious packages that were modified, allowing them to steal private key material…

    solana-labs solana-web3.js @solana/web3.js npm
  • High 7.5
    CVE-2024-30253

    Handling untrusted input can result in a crash, leading to loss of availability / denial of service

    @solana/web3.js is the Solana JavaScript SDK. Using particular inputs with `@solana/web3.js` will result in memory exhaustion (OOM). If you have a server, client, mobile, or desktop product that accepts untrusted input for use with `@solana/web3.js`, your app…

    solana-labs solana-web3.js @solana/web3.js npm