PyPI · pypi.org
solana-web3
Py Import Time Subprocess: subprocess call with shell=True — passes argv to /bin/sh.
Why PkgRadar flagged 1.0.0
| Severity | Signal | Evidence |
|---|---|---|
| medium | Py Import Time Subprocess | subprocess call with shell=True — passes argv to /bin/sh. · solana-web3/__init__.py |
| high | Webhook Exfil Endpoint | matched "api.telegram.org/bot" · solana-web3/__init__.py |
| medium | Py Import Time Network Call | Network call (urllib/requests/httpx/http.client) at install or import time. · solana-web3/__init__.py |
| medium | Credential file access | matched "id_rsa" · solana-web3/__init__.py |
Scanned versions
| Version | Verdict | Score | Scanned (UTC) |
|---|---|---|---|
1.0.0 | High risk | 122 | 2026-06-07 |
Block this in CI
pkgradar gate --ecosystem pypi solana-web3==1.0.0