Summary
Togoder Security scanned the npm package @solana/rpc-subscriptions-channel-websocket@3.0.3 on Oct 4, 2026. An AI review of 5 source files produced 1 medium, 2 low severity findings. The overall verdict is medium: the findings flag risky but common patterns (dynamic code, unsafe defaults, broad file or network access) rather than confirmed malware.
Findings 3
Insecure WebSocket implementation
NPS-26EDE7BBD337
The code uses a WebSocket connection without validating or sanitizing the URL. If the URL is user-controlled, it could lead to connection to malicious servers or SSRF. However, the URL is passed directly to the WebSocket constructor, which is standard for a library.
Unbounded resource consumption
NPS-E30554B06A78
The code sets max listeners to Number.MAX_SAFE_INTEGER, which could lead to memory leaks if listeners are not properly removed. Although cleanup is attempted, this pattern is risky.
Potential denial of service
NPS-CD09A09B8B2A
The send method uses a buffer drain watcher with setInterval polling every 16ms. If the buffer never drains, it could cause an infinite loop or resource exhaustion. However, there are checks for open state and closure.
Files reviewed
| File | Verdict | What the reviewer saw |
|---|---|---|
| dist/index.node.cjs | medium | The code appears to be a legitimate Solana WebSocket channel implementation but has some resource management and URL handling concerns that warrant a warning. |
| dist/index.browser.cjs | safe | The code implements a WebSocket channel for Solana RPC subscriptions using standard WebSocket APIs and package dependencies, with no malicious patterns detected. |
| dist/index.browser.mjs | safe | No malicious patterns detected; the code is a legitimate Solana WebSocket channel implementation with no data exfiltration, credential harvesting, or other security concerns. |
| dist/index.native.mjs | safe | No malicious patterns detected; the code is a legitimate Solana WebSocket channel implementation with no data exfiltration, credential harvesting, obfuscation, or other red flags. |
| dist/index.node.mjs | safe | No malicious patterns detected; the code is a legitimate WebSocket channel implementation for Solana RPC subscriptions with no data exfiltration, credential harvesting, obfuscation, or suspicious behavior. |
Affected version ranges
None of the 2 scanned versions of @solana/rpc-subscriptions-channel-websocket are flagged high or critical. The latest scanned version, 5.0.0, is medium risk. Only versions we have scanned are listed; unscanned versions between them are not covered.
| Versions | Verdict | Count | Range | Top findings |
|---|---|---|---|---|
| 3.0.3 – 5.0.0 | Needs review | 2 | >=3.0.3 <=5.0.0 | Insecure WebSocket implementation |
| 2.1.1 | Not scanned | 1 | 2.1.1 |
Full list, including published versions not scanned yet: version ranges API.
Scanned versions of @solana/rpc-subscriptions-channel-websocket
Frequently asked questions
Is @solana/rpc-subscriptions-channel-websocket safe to use?
No confirmed malware was found in @solana/rpc-subscriptions-channel-websocket@3.0.3, but the review flagged 1 medium, 2 low severity findings for risky patterns worth checking before you rely on it.
Does @solana/rpc-subscriptions-channel-websocket contain malware?
No malware was identified in @solana/rpc-subscriptions-channel-websocket@3.0.3 when Togoder Security scanned it on Oct 4, 2026. A new version can still introduce malicious code, so scan the exact versions in your lockfile.
How was @solana/rpc-subscriptions-channel-websocket checked?
Togoder Security downloaded the published npm package and had an AI model read its 5 source files, looking for install scripts, credential access, network exfiltration, obfuscation, backdoors and crypto-wallet theft. The results are cached by file hash and shown here.
How do I scan @solana/rpc-subscriptions-channel-websocket together with the rest of my dependencies?
Upload your lockfile at https://security.togoder.click/scan or call the API documented at https://security.togoder.click/api-docs. Files that have already been scanned, like the ones in @solana/rpc-subscriptions-channel-websocket@3.0.3, cost nothing.