Open Source ·

@solana/web3.js stole private keys

Attackers compromised an npm publish-access account and published malicious @solana/web3.js versions 1.95.6 and 1.95.7 on December 3, 2024. The injected code added credential-stealing behavior to private-key handling paths and exfiltrated material to sol-rpc.xyz.

@solana/web3.js is the canonical Solana SDK for JavaScript clients and server-side systems. Many bots, backends, and automation tools use it near signing keys. A poisoned npm release therefore created a direct route to wallet material.

On December 3, 2024, malicious versions 1.95.6 and 1.95.7 were published to npm. The official advisory says a publish-access account was compromised and that the affected releases were available for several hours before removal. The safe upgrade path was 1.95.8.

The added code targeted key-handling flows. Socket and other researchers described an addToQueue exfiltration function and calls from private-key related code paths. The destination domain was sol-rpc.xyz, an attacker-controlled endpoint designed to look plausible in the Solana ecosystem.

The highest-risk systems were those that passed private keys directly through the library: bots, backend services, and custodial tooling. The Register reported theft estimates around $160,000 and noted the package's large weekly download base, but the artifact record keeps confirmed malicious versions separate from broad ecosystem exposure.

Appendix · Affected releases

@solana/web3.js npm fixed 1.95.8
1.95.6 no sample yet
1.95.7 no sample yet
  • The GitHub advisory marks 1.95.6 and 1.95.7 as affected and 1.95.8 as patched.
  • Socket reported the malicious releases were live for roughly five hours on December 3, 2024. The Register reported theft estimates around $160,000.
  • The impact users value records broad weekly download exposure reported in public coverage, not confirmed victim count.

References

  1. CVE-2024-54134nvd.nist.gov
  2. MITRE CVE-2024-54134cve.mitre.org
  3. Researchers Uncover Backdoor in Solana's Web3.js npm Librarythehackernews.com
  4. Critical Security Alert - Solana Web3.js Library Compromisecyfrin.io
  5. @solana/web3.js v1.95.8 releasegithub.com
  6. Solana JavaScript SDK backdoored to steal keys and fundstheregister.com
  7. @solana/web3.js private key leakage advisorygithub.com
  8. Supply Chain Attack - Solana Web3.js Librarysocket.dev

Source record: oss/attacks/solana_web3.js/meta.yaml