Loading story…
Researchers uncovered a coordinated npm supply-chain campaign in which five packages published from the galedonovan account impersonated trusted Solana and Ethereum libraries to steal private wallet keys. The packages used function hooking to intercept sensitive material during normal key-handling operations, including Solana Base58 decode() flows and the Ethereum wallet constructor, then exfiltrated the keys in plaintext to a hardcoded Telegram bot, @Test20131_Bot, and a group administered by @crypto_sol3.
The campaign affected both direct installs and transitive dependencies, with bs58-basic pulling in the malicious base-x-64, while ethersproject-wallet closely mimicked the legitimate @ethersproject/wallet 5.8.0 release with only a small injected change. One package, base_xd, was removed within minutes, but researchers said it shared the same payload and infrastructure as base-x-64; four packages were still live when the activity was disclosed. Developers who installed the packages were urged to remove them immediately, treat any exposed private keys as compromised, rotate keys, and move funds to new wallets.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Socket publicly reported the malicious npm supply-chain campaign, linked the five packages to the same exfiltration infrastructure, and submitted takedown requests. It advised affected developers to remove the packages immediately, rotate any exposed private keys, and move funds from potentially compromised wallets.
The package base_xd was removed from npm within five minutes of publication, but researchers found it used the same payload and Telegram-based exfiltration infrastructure as base-x-64. The other four malicious packages remained available at the time of discovery.
Five npm packages published under the account "galedonovan" impersonated Solana and Ethereum libraries and were designed to steal private wallet keys from developers. The campaign included packages such as base-x-64, bs58-basic, and ethersproject-wallet, with some packages also creating transitive compromise paths through dependencies.
Socket's Threat Research Team confirmed that the hardcoded Telegram bot @Test20131_Bot and associated group administered by @crypto_sol3 were active, enabling plaintext exfiltration of stolen private keys. The malware hooked key-handling functions in Solana and Ethereum libraries while preserving normal behavior to avoid detection.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 16 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers at Socket identified a malicious NuGet package named 'Netherеum.All' that impersonated the legitimate Nethereum library by using a Cyrillic 'e' in its name, making it visually indistinguishable from the original. The package was designed to exfiltrate sensitive wallet information, including mnemonics, private keys, keystore JSON, and signed transaction data, by sending it to a command and control server themed after Solana. The threat actor leveraged the popularity of Nethereum, a widely used .NET library for Ethereum, to target developers and users in the cryptocurrency ecosystem. The malicious package was first published on October 16, 2025, and was reported to the NuGet security team two days later, leading to its removal and the suspension of the associated publisher account. Further investigation linked this campaign to a previous typosquat, 'NethereumNet', which used similar exfiltration techniques and was also removed by NuGet. The attack highlights the risks of homoglyph abuse in package registries and the ongoing threat of supply chain attacks targeting cryptocurrency-related software.
Jul 12, 2026
Two malicious Rust packages, named 'faster_log' and 'async_println', were discovered on the official Crates.io repository, where they were designed to steal private keys from cryptocurrency wallets, specifically targeting Solana and Ethereum users. These packages were downloaded nearly 8,500 times before their removal, with 'faster_log' accounting for 7,200 downloads and 'async_println' for 1,200. The malicious crates impersonated the legitimate 'fast_log' crate by copying its README file, repository metadata, and maintaining the original logging functionality to avoid suspicion among developers. The attackers embedded a payload within the crates that, upon execution, scanned the victim's environment and project source files for sensitive information, including hex strings resembling Ethereum private keys, Base58 strings similar to Solana keys or addresses, and bracketed byte arrays that could contain keys or seeds. When such data was found, it was bundled with the file path and line number and exfiltrated to a hardcoded Cloudflare Worker URL, which was confirmed to be live and accepting POST requests during the investigation. The malicious activity was discovered by researchers at the code security company Socket, who promptly reported it to Crates.io. In response, Crates.io removed both packages and suspended the publishing accounts, 'rustguruman' and 'dumbnbased', on September 24th. The incident highlights the risks associated with open-source software supply chains, where attackers can leverage trusted repositories to distribute malware to unsuspecting developers. The malicious crates did not have any dependent downstream crates, which may have limited the spread of the compromise. The attack demonstrates the sophistication of threat actors in mimicking legitimate projects to evade detection and the importance of vigilant monitoring of package repositories. The use of a legitimate logging functionality within the malicious crates further reduced suspicion, allowing the packages to remain undetected for several months. The exfiltration endpoint used by the attackers was not an official Solana RPC endpoint, indicating a deliberate attempt to disguise the data theft operation. This supply chain attack underscores the need for developers to verify the authenticity of third-party packages and for repository maintainers to implement robust security controls. The incident also serves as a warning to the broader cryptocurrency and developer communities about the ongoing threat of targeted attacks seeking to compromise digital assets through software dependencies. Security researchers continue to monitor for similar threats and advise immediate removal of the affected packages from any projects.
Jun 29, 2026
Security researchers have uncovered multiple campaigns involving malicious npm packages designed to steal developer credentials and sensitive information from Windows, macOS, and Linux systems. In one operation, ten typosquatted packages impersonated popular libraries such as TypeScript, discord.js, ethers.js, and others, using sophisticated obfuscation, fake CAPTCHA prompts, and postinstall hooks to deploy an information stealer that harvested credentials from system keyrings, browsers, and authentication services. The malware executed in a new terminal window to evade detection and sent stolen data, including IP addresses, to external servers. Another large-scale campaign, dubbed 'PhantomRaven,' involved 126 npm packages and over 86,000 downloads, targeting authentication tokens, CI/CD secrets, and GitHub credentials. These packages leveraged remote dynamic dependencies to fetch and execute payloads during installation, profiling infected devices and exfiltrating secrets for potential supply chain attacks. The attackers employed techniques such as slopsquatting, where AI-generated package recommendations led developers to install non-existent, malicious packages. Some packages impersonated tools from GitLab and Apache, and many remained available on npm at the time of reporting. The campaigns highlight the ongoing risks in the npm ecosystem, with attackers exploiting both user trust and platform weaknesses to compromise developer environments and CI/CD pipelines. Security experts warn that the theft of tokens and credentials could enable further attacks, including the introduction of malicious code into legitimate projects and broader supply chain compromises.
Jun 29, 2026