@solana/web3.js

3.1.1 · 19 Oct 2026MIT1.7M / weekRepository Homepage npm Atom feed

Security advisories

From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.

Paste your package.json, or type the range you declare for @solana/web3.js. It is read in your browser and sent nowhere.

Line	Newest	Where it stands
	3.1.1	No known advisory
	1.99.0	Safe from 1.95.8
	0.98.0	99 open advisories, worst high · last release Mar 2021, no longer updated

Your version

High
Modified package published to npm, containing malware that exfiltrates private key materialGHSA-jcxm-7wvp-g6p5 · 4 Dec 2024
- 1.x1.95.6 – 1.95.7Fixed in 1.95.8
High
Handling untrusted input can result in a crash, leading to loss of availability / denial of serviceGHSA-8m45-2rjm-j347 · 17 Apr 2024
- 1.x1.0.0 – 1.91.2Fixed in 1.91.3
- 0.98.x and older0.0.1 – 0.98.0No fix, no longer updated · move to 1.91.3
Advisory
Malicious code in @solana/web3.js (npm)MAL-2024-11183 · 3 Dec 2024
- 1.x1.95.6 – 1.95.7Fixed in 1.95.8

What npm and deps.dev say about the latest release. Signals, not a verdict.

Reading npm and deps.dev…

Registry facts last checked 23 Oct 2026. Releases and advisories last read 23 Oct 2026.