Executive brief
A compromised npm publishing account allowed attackers to inject malware into the Solana web3.js JavaScript library, a critical tool used by cryptocurrency applications. The malware exfiltrates users' private cryptographic keys, enabling theft of digital funds from applications that directly manage these keys. The malicious versions were detected and removed within hours, but any applications that updated between 3:20 PM and 8:25 PM UTC on December 3, 2024 may be at risk.
Technical details
This vulnerability involves supply-chain compromise via a compromised npm package maintainer account, allowing publication of unauthorized versions containing malware. The attack vector is network-based, requiring only that developers update the package during the compromise window; no authentication or elevated privileges are required. The malware targets applications that handle private keys directly (primarily automated bots and custodial systems), exfiltrating cryptographic key material that can be used to drain associated cryptocurrency wallets. Affected versions 1.95.6 and 1.95.7 were unpublished after discovery. The patch is available in version 1.95.8, and all developers should upgrade immediately. Non-custodial wallets that don't expose private keys during transactions are not vulnerable.
Affected products
- Solana web3.js 1.95.6, 1.95.7 (vulnerable); fixed in 1.95.8
Timeline
- 2024-12-04: disclosed: Security advisory published
- 2024-12-03: exploited: Malicious versions 1.95.6 and 1.95.7 published between 3:20 PM and 8:25 PM UTC
- 2024-12-04: patched: Version 1.95.8 released with fix; malicious versions unpublished