Full Report
A supply chain attack on the Solana library utilizing malicious npm versions has exposed private keys, putting crypto funds at risk
Analysis Summary
# Incident Report: Solana Library Supply Chain Attack
## Executive Summary
A supply chain attack successfully targeted the widely used `@solana/web3.js` npm library, resulting in the brief publication of malicious package versions (1.95.6 and 1.95.7) on December 2, 2024. Attackers injected code designed to steal private cryptocurrency keys from projects that updated their dependencies within a five-hour window, leading to estimated losses between \$130,000 and \$160,000 in SOL tokens. The incident was resolved by removing the malicious versions and urging users to immediately update to 1.95.8 and rotate compromised keys.
## Incident Details
- Discovery Date: December 2, 2024 (shortly after publication)
- Incident Date: December 2, 2024
- Affected Organization: Developers and users integrating compromised versions of the `@solana/web3.js` npm library.
- Sector: Cryptocurrency / Web3 Infrastructure
- Geography: Global (targeting the open-source software ecosystem)
## Timeline of Events
### Initial Access
- Date/Time: December 2, 2024 (within a five-hour window)
- Vector: Compromise of library maintainer accounts, likely via phishing, leading to the injection of malicious code into official package builds.
- Details: Attackers introduced compromised versions 1.95.6 and 1.95.7 of the `@solana/web3.js` library.
### Lateral Movement
The nature of this supply chain attack means direct lateral movement across the victim's *network* was not the primary objective. The attack focused on **accessing sensitive data (private keys)** within the execution environment of the targeted applications *after* the malicious library was integrated and executed.
### Data Exfiltration/Impact
- **Data Stolen:** Private keys used by decentralized applications (dApps) and automated bots, which handle sensitive operations.
- **Method:** Malicious code, specifically a backdoor function named `addToQueue`, hijacked key-sensitive application processes to send private keys to an attacker-controlled server (`sol-rpc[.]xyz`).
### Detection & Response
- **Detection:** Security researchers identified the malicious package versions and exposed the backdoor functionality.
- **Response Actions:** Malicious versions 1.95.6 and 1.95.7 were promptly removed from npm. Solana Labs and experts issued immediate advisories to update to version 1.95.8.
## Attack Methodology
- **Initial Access:** Supply chain injection via compromise of library maintainer accounts (likely phishing).
- **Persistence:** Not explicitly detailed, but the primary persistence mechanism was embedding the malicious code within the trusted library dependency.
- **Privilege Escalation:** Not explicitly detailed, but the injection allowed the malicious code to execute with the privileges necessary to access application memory/processes handling private keys.
- **Defense Evasion:** By being published within a legitimate, widely used library, the code bypassed standard dependency vetting processes.
- **Credential Access:** Direct theft of private keys from the application processes using the compromised library dependency.
- **Discovery:** Attackers likely scoped targets based on known uses of the library in key-handling applications.
- **Lateral Movement:** Internal network movement was circumvented; the focus was on harvesting secrets directly upon execution.
- **Collection:** Private keys were collected from the application runtime environment.
- **Exfiltration:** Keys were sent to an external attacker-controlled server (`sol-rpc[.]xyz`).
- **Impact:** Theft of cryptocurrency assets (SOL tokens).
## Impact Assessment
- **Financial:** Estimated loss between \$130,000 and \$160,000 (SOL tokens).
- **Data Breach:** Sensitive cryptographic private keys exploited. Non-custodial wallets were generally safe, but dApps and bots relying on the library were exposed.
- **Operational:** Disruption to development teams needing to audit, update, and rotate keys.
- **Reputational:** Damage to trust in the open-source supply chain reliability, particularly within the Solana ecosystem. (Major wallets like Phantom and Coinbase confirmed they were unaffected.)
## Indicators of Compromise
- **Network Indicators (Defanged):** `sol-rpc[.]xyz` (attacker-controlled exfiltration endpoint).
- **File Indicators:** Malicious code injected into `@solana/web3.js` versions **1.95.6** and **1.95.7**. Backdoor function named `addToQueue`.
- **Behavioral Indicators:** Application processes exhibiting abnormal outbound network connections transferring sensitive cryptographic material immediately following dependency update.
## Response Actions
- **Containment Measures:** Immediate removal of compromised versions (1.95.6 and 1.95.7) from the npm registry.
- **Eradication Steps:** Users advised to audit dependencies and immediately update to version 1.95.8.
- **Recovery Actions:** Users handling private keys were instructed to rotate those keys, including multi-sig and program authorities, if they suspect compromise.
## Lessons Learned
- The attack highlights the extreme vulnerability of established, widely-used open-source software supply chains, especially in high-value ecosystems like cryptocurrency.
- Relying solely on automated dependency updates without rigorous component risk analysis is insufficient, as evidenced by the successful injection into a major library.
- The attackers combined their knowledge of supply chain attacks with the motivation of cryptocurrency theft.
## Recommendations
- Implement dependency dependency pinning and strict version control to prevent instant automatic ingestion of newly published (and potentially malicious) versions.
- Enhance continuous security auditing of third-party components, focusing on runtime behavior rather than just static analysis.
- Developers handling private keys must adopt a "zero-trust" approach to dependency updates, treating any new library version as potentially hostile until verified, especially if key rotation is an option post-compromise.
- For crypto applications, explore solutions that minimize or eliminate the need to handle private keys client-side or within transient build environments.