What our analysis found

Mosaic Wallet, used by 4,000,000 people, showed no malicious code in Extension Auditor's review. It was last updated in June 2026.

The source code reveals a legitimate Solana wallet tipping extension: injects donate buttons on by looking up Solana Name Service records for Twitter handles, routes SNS lookup and donation messages to the offscreen document using Coinbase CDP SDK, and all network calls go exclusively to declared host_permissions (Helius mainnet RPC for SNS, Coinbase CDP for wallet management, devnet Solana for alpha transactions). The ML signal is entirely explained by bundled SDK crypto libraries: the ~872 KB JS bundle ships SHA-256 (with round-constant arrays), Borsh binary codec, Buffer polyfill, encoders, and ipaddr — all of which are legitimate dependencies of the @ and @ stacks and directly inflate counts for js_fromcharcode, js_hex_obfuscation, js_encoded_strings, and js_exclamation. The third-party score's "high" likelihood flags only newness and low user count, not suspicious behavior, and corroborates a benign verdict; the permhash cluster's 9% malware peers are unrelated extensions that happen to share the same three broad permissions.