Malicious code in solana-web3-community (npm)

The solana-web3-community package masquerades as the official @solana/web3.js SDK to deceive developers. Upon import, it executes code that steals credentials from common key files (~/.config/solana/id.json, ~/.ssh/id_rsa, ~/.aws/credentials, project.env) and environment variables with names indicative of secrets. This data is sent to a Telegram bot controlled by the attacker. The package also modifies the Solana CLI config to redirect RPC calls to an attacker-controlled node, enabling transaction hijacking. It provides a remote shell backdoor by polling the Telegram bot for commands and executing them on the victim's machine. Persistence is maintained by adding a cron job that relaunches the malicious code on system reboot. The affected versions are 1.0.0 through 1.0.5 inclusive.

This malicious package compromises developer machines by stealing a wide range of sensitive credentials and secrets, including SSH keys, cloud credentials, and blockchain wallet keys. It enables attackers to intercept and manipulate Solana blockchain transactions by redirecting RPC calls. The remote shell backdoor allows full command execution on the victim's system, leading to complete system compromise and persistent access.

No official patch or remediation is currently available. Users should immediately uninstall the solana-web3-community package if present. Avoid using packages that impersonate official SDKs and verify package authenticity before installation. Review and rotate any potentially compromised credentials and keys. Monitor for unauthorized cron jobs and remove any suspicious entries. Check Solana CLI configuration files for unauthorized modifications and restore them to trusted settings.