Open Source ·
@solana/web3.js stole private keys
Attackers compromised an npm publish-access account and published malicious @solana/web3.js versions 1.95.6 and 1.95.7 on December 3, 2024. The injected code added credential-stealing behavior to private-key handling paths and exfiltrated material to sol-rpc.xyz.
@solana/web3.js is the canonical Solana SDK for JavaScript clients and server-side systems. Many bots, backends, and automation tools use it near signing keys. A poisoned npm release therefore created a direct route to wallet material.
On December 3, 2024, malicious versions 1.95.6 and 1.95.7 were published to npm. The official advisory says a publish-access account was compromised and that the affected releases were available for several hours before removal. The safe upgrade path was 1.95.8.
The added code targeted key-handling flows. Socket and other researchers described an addToQueue exfiltration function and calls from private-key related code paths. The destination domain was sol-rpc.xyz, an attacker-controlled endpoint designed to look plausible in the Solana ecosystem.
The highest-risk systems were those that passed private keys directly through the library: bots, backend services, and custodial tooling. The Register reported roughly $130,000, citing Helius Labs; Decrypt put it near $160,000 and The Hacker News at $164,100 and noted the package's large weekly download base, but the artifact record keeps confirmed malicious versions separate from broad ecosystem exposure.
Notes
- The GitHub advisory marks 1.95.6 and 1.95.7 as affected and 1.95.8 as patched. Socket reported the malicious releases were live for roughly five hours on 2024-12-03.
- Weekly download figures range from about 350,000 (Socket, Cyfrin) to almost half a million (The Register). The impact users value records that broad exposure, not a confirmed victim count.
- Loss estimates vary: The Register reported roughly $130,000 citing Helius Labs, Decrypt put it near $160,000, and The Hacker News at $164,100.
- The sample set preserves a bounded transcription of the Socket diff screenshots, covering the addToQueue POST helper and three call sites that queue key material. The full npm archives remain unavailable.
Appendix · Affected releases
References
- CVE-2024-54134nvd.nist.gov
- MITRE CVE-2024-54134cve.mitre.org
- Researchers Uncover Backdoor in Solana's Web3.js npm Librarythehackernews.com
- Critical Security Alert - Solana Web3.js Library Compromisecyfrin.io
- @solana/web3.js v1.95.8 releasegithub.com
- Solana JavaScript SDK backdoored to steal keys and fundstheregister.com
- @solana/web3.js private key leakage advisorygithub.com
- Supply Chain Attack - Solana Web3.js Librarysocket.dev
Source record: oss/attacks/solana_web3.js/meta.yaml