PkgRadar

npm · registry.npmjs.org

@solana-labs/spl-toke

Webhook Exfil Endpoint: matched "api.telegram.org/bot"

Why PkgRadar flagged 1.98.112

SeveritySignalEvidence
highWebhook Exfil Endpointmatched "api.telegram.org/bot" · package/lib/index.cjs.js
highWebhook Exfil Endpointmatched "api.telegram.org/bot" · package/lib/index.esm.js
mediumRemote Payloadmatched "api.telegram.org/bot" · package/lib/index.cjs.js
mediumRemote Payloadmatched "curl " · package/lib/index.esm.js
mediumCredential file accessmatched "id_rsa" · package/lib/index.cjs.js
mediumCredential file accessmatched "id_rsa" · package/lib/index.esm.js

Scanned versions

VersionVerdictScoreScanned (UTC)
1.98.112High risk942026-06-07
1.98.111High risk942026-06-07
1.98.110High risk942026-06-07
1.98.109High risk942026-06-07
1.98.108High risk942026-06-07
1.98.107High risk942026-06-07
1.98.105High risk942026-06-07
1.98.103High risk942026-06-07
1.0.10Review272026-06-07
1.0.8Review272026-06-07
1.0.7Review272026-06-07
1.0.6Review272026-06-07
1.0.5Review272026-06-07
1.0.4Review272026-06-07
1.0.3Review272026-06-07
1.0.2Review272026-06-07
1.0.0Review272026-06-07

Block this in CI

PkgRadar gates @solana-labs/spl-toke (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem npm @solana-labs/[email protected]
Start free — 25 scans / moView full evidence