# @solana/rpc-subscriptions-channel-websocket@5.0.0 security report (npm)

- Verdict: **Needs review** (risk level: medium)
- Scanned: 2026-10-04T16:17:02.000Z
- Files reviewed: 5
- Findings: 1 medium, 2 low severity findings
- Report: https://security.togoder.click/npm/@solana/rpc-subscriptions-channel-websocket@5.0.0
- Source: Togoder Security (https://security.togoder.click), AI source-code review

## Summary

Togoder Security scanned the npm package @solana/rpc-subscriptions-channel-websocket@5.0.0 on Oct 4, 2026. An AI review of 5 source files produced 1 medium, 2 low severity findings. The overall verdict is medium: the findings flag risky but common patterns (dynamic code, unsafe defaults, broad file or network access) rather than confirmed malware.

## Findings

### [medium] Insecure WebSocket implementation

Finding ID: `NPS-26EDE7BBD337`

File: `dist/index.node.cjs`

The code uses a WebSocket connection without validating or sanitizing the URL. If the URL is user-controlled, it could lead to connection to malicious servers or SSRF. However, the URL is passed directly to the WebSocket constructor, which is standard for a library.

### [low] Unbounded resource consumption

Finding ID: `NPS-E30554B06A78`

File: `dist/index.node.cjs`

The code sets max listeners to Number.MAX_SAFE_INTEGER, which could lead to memory leaks if listeners are not properly removed. Although cleanup is attempted, this pattern is risky.

### [low] Potential denial of service

Finding ID: `NPS-CD09A09B8B2A`

File: `dist/index.node.cjs`

The send method uses a buffer drain watcher with setInterval polling every 16ms. If the buffer never drains, it could cause an infinite loop or resource exhaustion. However, there are checks for open state and closure.

## Files reviewed

- `dist/index.node.cjs` (medium): The code appears to be a legitimate Solana WebSocket channel implementation but has some resource management and URL handling concerns that warrant a warning.
- `dist/index.browser.cjs` (safe): The code implements a WebSocket channel for Solana RPC subscriptions using standard WebSocket APIs and package dependencies, with no malicious patterns detected.
- `dist/index.browser.mjs` (safe): No malicious patterns detected; the code is a legitimate Solana WebSocket channel implementation with no data exfiltration, credential harvesting, or other security concerns.
- `dist/index.native.mjs` (safe): No malicious patterns detected; the code is a legitimate Solana WebSocket channel implementation with no data exfiltration, credential harvesting, obfuscation, or other red flags.
- `dist/index.node.mjs` (safe): No malicious patterns detected; the code is a legitimate WebSocket channel implementation for Solana RPC subscriptions with no data exfiltration, credential harvesting, obfuscation, or suspicious behavior.

## Version ranges

None of the 2 scanned versions of @solana/rpc-subscriptions-channel-websocket are flagged high or critical. The latest scanned version, 5.0.0, is medium risk. Only versions we have scanned are listed; unscanned versions between them are not covered.

- 3.0.3 – 5.0.0 (`>=3.0.3 <=5.0.0`): medium (Insecure WebSocket implementation)
- 2.1.1 (`2.1.1`): not scanned

## Scanned versions

- [5.0.0](https://security.togoder.click/npm/@solana/rpc-subscriptions-channel-websocket@5.0.0): medium, 2026-10-04T16:17:02.000Z
- [3.0.3](https://security.togoder.click/npm/@solana/rpc-subscriptions-channel-websocket@3.0.3): medium, 2026-10-04T16:05:05.000Z

AI analysis is guidance, not a guarantee. Methodology: https://security.togoder.click/methodology