Open Source 2024-12-03 · 0 days ·Credential Theft, Financial Exploitation

@solana/web3.js stole private keys

Attackers compromised an npm publish-access account and published malicious @solana/web3.js versions 1.95.6 and 1.95.7 on December 3, 2024. The injected code added credential-stealing behavior to private-key handling paths and exfiltrated material to sol-rpc.xyz.

Story

@solana/web3.js is the canonical Solana SDK for JavaScript clients and server-side systems. Many bots, backends, and automation tools use it near signing keys. A poisoned npm release therefore created a direct route to wallet material.

On December 3, 2024, malicious versions 1.95.6 and 1.95.7 were published to npm. The official advisory says a publish-access account was compromised and that the affected releases were available for several hours before removal. The safe upgrade path was 1.95.8.

The added code targeted key-handling flows. Socket and other researchers described an addToQueue exfiltration function and calls from private-key related code paths. The destination domain was sol-rpc.xyz, an attacker-controlled endpoint designed to look plausible in the Solana ecosystem.

The highest-risk systems were those that passed private keys directly through the library: bots, backend services, and custodial tooling. The Register reported theft estimates around $160,000 and noted the package's large weekly download base, but the artifact record keeps confirmed malicious versions separate from broad ecosystem exposure.

Affected Artifacts

@solana/web3.js

npm · repository · Source Archive
Observed
2024-12-03
Compromised Versions
Fixed
1.95.8
Hashes
  • sha256:cd9e0af30eee5b6935335e7969f9866d595b0c5301e15a2be54c9373f067f9d3
  • The GitHub advisory marks 1.95.6 and 1.95.7 as affected and 1.95.8 as patched.
  • Socket reported the malicious releases were live for roughly five hours on December 3, 2024. The Register reported theft estimates around $160,000.
  • The impact users value records broad weekly download exposure reported in public coverage, not confirmed victim count.

Incident Context

Motive
Financial Gain
Cause
Compromised Account Credentials
Transitive
No
User Impact
500000

External References

Source record: oss/attacks/solana_web3.js/meta.yaml