ClosedPatched

@solana/web3.js npm package backdoored to steal private keys

@solana/web3.js (npm)

A publish-access account for @solana/web3.js was compromised. Malicious versions 1.95.6 and 1.95.7, live on npm from 15:20 to 20:25 UTC on 2024-12-03, exfiltrated private key material from apps and bots that handle keys directly. Non-custodial wallets were generally not affected. Fixed in 1.95.8.

Why this severity: CVSS 8.3 (v4, GitHub); malicious npm release

Started: Dec 3, 2024
Closed: Dec 4, 2024
CVE: CVE-2024-54134

Node.js
npm
#Solana
#Crypto
Supply chain

Follow this incident

RSS
JSON
llms.txt

Updated Dec 4, 2024

Affected

1.95.6
1.95.7

Fixed in

1.95.8

Timeline2

Dec 4, 2024
GitHub advisory GHSA-jcxm-7wvp-g6p5 published; upgrade to 1.95.8
Source
Dec 3, 2024
Malicious 1.95.6 and 1.95.7 published to npm (15:20-20:25 UTC), then unpublished
Source

Advisories2

GHSA-jcxm-7wvp-g6p5: modified package published to npm, containing malware that exfiltrates private key materialSolana (GitHub) · Dec 4, 2024
NVD: CVE-2024-54134NVD · Dec 4, 2024

News & write-ups1

Supply chain attack detected in Solana's web3.js librarySocket · Write-up

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Get notified