Summary
In early December 2024, attackers spear-phished a member of the Solana team who had publish rights to @solana/web3.js, the core JavaScript library for building on Solana, downloaded about 350,000 times a week. They pushed two malicious versions carrying a backdoor that quietly stole the private keys any app used to sign transactions and shipped them to the attacker's wallet. It was live for about five hours. It is the npm-account-takeover playbook aimed squarely at crypto, where a poisoned dependency does not just run a miner, it empties wallets.
How it happened
The attackers spear-phished a member of the @solana npm organisation who held publish access, routing them to a clone of the npm website where they entered their password and a one-time 2FA code, which the attacker used to log in. With that access, they published two malicious versions (1.95.6 and 1.95.7) of @solana/web3.js, tracked as CVE-2024-54134.
The payload was tailored to crypto. The malicious versions added a function (addToQueue) that hooked Solana's key-handling routines (account creation, Keypair.fromSecretKey, and the signing-instruction builders), captured the private keys used to sign transactions, and exfiltrated them, disguised as ordinary CloudFlare headers, to an attacker-controlled domain (sol-rpc[.]xyz). Any application or bot that updated to the poisoned version and handled signing keys leaked them straight to the attacker. It is a supply-chain attack on a core crypto SDK, where the backdoor steals keys rather than CPU cycles.
The damage
The malicious versions were live for roughly five hours, and an estimated $130,000 to $190,000 in cryptocurrency was stolen (around $160,000 by most on-chain estimates), mostly from bots and backend services that updated quickly and signed with exposed keys. A clean version (1.95.8) was released once the compromise was found. The loss was limited by the short window and by the fact that it mainly hit projects holding keys server-side; non-custodial wallets, which generally do not expose private keys to the library, were not affected. Given the library's centrality to the Solana ecosystem, though, it could have been far worse.
Why Solana web3.js still matters
It shows the npm-account-takeover attack, the same class as ua-parser-js, aimed specifically at crypto: the payload steals signing keys, not just compute. It also shows that ordinary two-factor authentication is not a silver bullet, because the attacker phished the one-time code along with the password. The defences follow: require phishing-resistant 2FA (FIDO2 or passkeys, which cannot be phished this way) on publish accounts; pin dependencies and review updates so a freshly published core SDK never auto-deploys to systems that hold keys; and keep signing keys out of reach of application and dependency code, in a hardware module or a dedicated signer, so a poisoned library cannot read them. It shares the same late-2024 drainer-via-dependency theme as the Ledger Connect Kit attack.
How to fix it
- Pin or upgrade to the clean version (1.95.8) and rebuild from a clean lockfile.
- Treat every private key handled by code that ran a malicious version as compromised: rotate keys and move funds to new wallets immediately.
- Audit for the injected exfiltration function and any outbound traffic to the attacker's address or domain.
How to avoid it
- Require phishing-resistant 2FA (FIDO2 or passkeys) on publish accounts; ordinary 2FA codes can be phished by a fake login page, which is how this happened.
- Pin dependencies and review updates, and never let a freshly published version of a core SDK auto-deploy to systems that hold keys.
- Keep signing keys out of reach of application and dependency code, in an HSM or dedicated signer, so a poisoned library cannot read them.
- Monitor your critical dependencies for unexpected releases and pull from a vetted internal mirror.
References
Related vulnerabilities
All Supply chain →- CRITICALGHSA-93qj-5q5v-3c2h
Trojanized pantheon-agents 0.6.1 and 0.6.2 on PyPI ship a credential stealer (supply-chain account compromise)
- CRITICALNPM-REDHAT-MIASMA-2026
In June 2026 the npm supply-chain worm finally produced something genuinely new and frightening: malicious packages that were signed and carried valid build provenance. Attackers used a compromised GitHub account inside Red Hat's own organisation to publish trojanised versions of 31 packages in the @redhat-cloud-services namespace through Red Hat's legitimate CI pipeline, so the poisoned releases arrived with authentic attestations proving they were built by the real build system. The payload, nicknamed Miasma, was a lightly re-skinned copy of Mini Shai-Hulud, a worm that a group called TeamPCP had open-sourced for anyone to reuse weeks earlier. No Red Hat customers were harmed, because Red Hat strips install scripts before deployment, but the permanent lesson is uncomfortable: a signature proves where a package was built, not that the build was clean.
- CRITICALNPM-AXIOS-2026
On 31 March 2026 the single most widely used HTTP client in the JavaScript world was turned into malware for about three hours. Axios carries well over 100 million weekly downloads and sits as a transitive dependency underneath a huge share of the npm ecosystem, so when a North Korea-nexus actor took over the maintainer's account and published two booby-trapped versions, the blast radius was enormous even though the bad versions were live only for one early-morning window. The poisoned releases pulled in a hidden dependency that ran on install and dropped a cross-platform remote access trojan onto developer machines and CI runners. It is the case study in why a few hours of a popular package being compromised is still a global incident, and in why a maintainer's own laptop is now a nation-state target.
- HIGHSC-NOTEPADPP-CHRYSALIS-2025
In 2025, a Chinese state-linked espionage group hijacked the update channel of Notepad++, one of the most widely installed Windows text editors, to plant a custom backdoor on a handful of carefully chosen targets. The attackers never touched Notepad++'s source code or its signing keys. Instead they compromised the third-party shared-hosting server that delivered updates, and abused the fact that the WinGUp updater shipped without any integrity check on what it downloaded (tracked as CVE-2025-15556). For machines on their target list, WinGUp was silently redirected to attacker-controlled servers that served a trojanized installer; everyone else kept receiving the genuine update. The campaign ran from roughly June to December 2025 and was only made public in February 2026 by Rapid7, with Kaspersky and Broadcom/Symantec corroborating it independently.
- HIGHSC-ESCAN-RELOAD-2026
On or around January 20, 2026, attackers who had broken into a regional update server for eScan, the antivirus product made by India's MicroWorld Technologies, pushed a trojanized Reload.exe through the legitimate update channel during a window of roughly two hours. The security software itself became the delivery vehicle for malware. The malicious binary carried eScan's code-signing identity, but its signature was actually invalid; it ran anyway because the updater trusted the channel rather than rigorously validating the signature. Once on a host, the malware rewrote the Windows HOSTS file to cut eScan off from its own update servers, blinded script scanning, and reached out to takedown-resistant command-and-control hosted on blockchain naming systems. Morphisec disclosed the campaign, with Kaspersky and Darktrace corroborating it independently.
- CRITICALNPM-SHAI-HULUD-2-2025
Shai-Hulud is the nightmare the npm ecosystem had long feared: a self-replicating worm. First seen in September 2025 and back in a more aggressive wave around 21-24 November 2025 ("The Second Coming"), it does not just poison one package and wait. When its malware runs in a developer's environment, it harvests every secret it can find, npm tokens, GitHub tokens, cloud keys, then uses those stolen npm tokens to automatically publish itself into other packages the victim maintains, spreading from maintainer to maintainer on its own. The second wave hit more than 25,000 GitHub repositories across roughly 500 compromised accounts, leaked the stolen secrets into public repos, and, if it failed to steal credentials, tried to wipe the victim's home directory. It is the moment supply-chain malware learned to propagate like a biological infection.