Malicious code in solana-dev-tools (npm)

The solana-dev-tools package (npm, version 1.0.0) contains a postinstall script that performs a multi-stage attack. Upon installation, it reads sensitive files such as Solana keypairs, SSH private keys, AWS credentials, and environment variables containing secrets. These are exfiltrated to a Telegram bot endpoint controlled by the attacker. If a Solana keypair is recovered, the script reconstructs it, queries the mainnet-beta balance, and transfers nearly all funds to a hardcoded attacker public key. Persistence is achieved by installing a cron job that reruns the malicious script on reboot. The malware includes sandbox evasion checks to detect containerized or analysis environments and suppress persistence in those cases. The package masquerades as legitimate Solana development CLI tools to deceive users.

Sensitive credentials and secrets are stolen from the victim's machine, including Solana wallet keys, SSH keys, AWS credentials, and various environment secrets. The attacker can drain Solana cryptocurrency balances from compromised wallets. Persistence on the infected system is established via a cron job, enabling repeated exfiltration and theft. The malicious package poses a significant risk to confidentiality and financial assets of developers using this tooling.

No official patch or remediation is currently documented. Users should avoid installing solana-dev-tools version 1.0.0 from untrusted sources. Remove the package and any related cron jobs if already installed. Monitor for suspicious network traffic to Telegram endpoints and unauthorized Solana transfers. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates. Consider using verified and trusted Solana development tools only.