Hackers Are Stealing Solana Wallets And Wiping Systems

Overview

Cybersecurity researchers have uncovered three sets of malicious packages distributed across the npm and Python Package Index (PyPI) repositories. These packages are designed to steal sensitive data and, in some cases, even delete files from infected systems.

Identified Malicious Packages

The identified malicious packages include typosquats—fraudulent packages mimicking legitimate ones—and entirely new malicious libraries. Below is a list of the compromised packages:

npm Packages

• @async-mutex/mutex (typosquat of async-mute)

• dexscreener (masquerading as a library for accessing liquidity pool data from decentralized exchanges (DEXs) and interacting with the DEX Screener platform)

• solana-transaction-toolkit

• solana-stable-web-huks

• cschokidar-next (typosquat of chokidar)

• achokidar-next (typosquat of chokidar)

• achalk-next (typosquat of chalk)

• csbchalk-next (typosquat of chalk)

• cschalk (typosquat of chalk)

PyPI Package

• pycord-self (typosquat of discord.py-self)

Solana-Focused Data Theft

Supply chain security firm Socket, which identified these malicious packages, reported that the first four npm packages are specifically designed to steal Solana private keys and exfiltrate them using Gmail's Simple Mail Transfer Protocol (SMTP) servers. The likely objective is to drain victims’ cryptocurrency wallets.

• solana-transaction-toolkit and solana-stable-web-huks go further by automatically transferring up to 98% of wallet funds to an attacker-controlled Solana address.

• These packages claim to provide Solana-specific functionalities but instead act as financial siphoning tools.

Why Gmail SMTP?

Using Gmail's SMTP servers allows the malware to bypass traditional security mechanisms:

• Firewalls and endpoint detection systems often trust Gmail's SMTP traffic, making it harder to flag as malicious.

• The malware can exfiltrate private keys undetected by many security solutions.

GitHub as a Distribution Channel

Researchers found two GitHub repositories linked to the attackers behind solana-transaction-toolkit and solana-stable-web-huks:

• moonshot-wif-hwan

• Diveinprogramming

These repositories, now removed, pretended to contain Solana development tools or DeFi automation scripts. Instead, they included references to the malicious npm packages.

One GitHub script named pumpfun-bump-script-bot was advertised as a trading bot for Raydium (a Solana-based DEX) but actually imported malicious code from solana-stable-web-huks.

Advanced Malware with a "Kill Switch"

The second set of npm packages included a particularly dangerous feature: a "kill switch" designed to wipe all files from project-specific directories.

• csbchalk-next operates similarly to other typosquatted versions of chokidar, with one key difference:

  • It only activates the file deletion command when it receives a "202" status code from the attacker's server.

• pycord-self, targeting Python developers, focuses on:

  • Capturing Discord authentication tokens.

  • Connecting infected systems to an attacker-controlled server for persistent backdoor access.

  • Running on both Windows and Linux systems.

Expanding Attack Surface: Roblox Users Targeted

Researchers also found malicious packages targeting Roblox users:

• Attackers have been distributing fraudulent libraries designed to steal data from Roblox players.

• These tools leverage open-source stealer malware like Skuld and Blank-Grabber.

• In 2023, Imperva discovered fake PyPI packages impersonating Roblox cheat and mod tools, tricking players into installing malware.

Key Takeaways & Recommendations

The emergence of these malicious packages highlights ongoing threats within open-source ecosystems. To protect against these risks, developers and users should:

1. Verify Package Authenticity – Always check the official repository and maintainers before installing an npm or PyPI package.

2. Inspect Source Code – Before running or integrating a package, manually review the source code for any unusual behaviors.

3. Monitor Dependencies – Use security tools to audit package dependencies, ensuring they have not been compromised.

4. Be Cautious with GitHub Repositories – Malicious actors are weaponizing GitHub by uploading fraudulent repositories that reference malicious packages.

5. Check API Calls and Network Traffic – Monitor package behavior for unexpected network connections, especially those exfiltrating data.

Conclusion

The discovery of these malicious npm and PyPI packages underscores the growing sophistication of supply chain attacks. By leveraging trusted platforms and exploiting human error, attackers continue to compromise developers and users alike. Vigilance, verification, and proactive security measures remain crucial in mitigating such threats.