Supply Chain Attack Detected in Solana's web3.js Library

A supply chain attack has been detected in versions 1.95.6 and 1.95.7 of the popular @solana/web3.js library, which receives more than ~350,000 weekly downloads on npm. These compromised versions contain injected malicious code that is designed to steal private keys from unsuspecting developers and users, potentially enabling attackers to drain cryptocurrency wallets.

What We Know So Far:

• Affected Versions: 1.95.6 and 1.95.7 of the @solana/web3.js library on npm.
• Malicious Activity: The injected code captures private keys and transmits them to a hardcoded address.
• Linked Wallet: The activity has been traced to the Solana address FnvLGtucz4E1ppJHRTev6Qv4X7g8Pw6WPStHCcbAKbfx.
• Cause: Believed to be the result of a social engineering/phishing attack targeting maintainers of the official Web3.js open source library maintained by Solana.

Potential Impact:

• Developers integrating these versions into their projects risk exposing their private keys.
• Users of applications relying on the compromised library may have their wallets drained if private keys are compromised.

Immediate Actions for Developers:

1. Check Dependencies: Audit your projects for any usage of @solana/web3.js and identify if versions 1.95.6 or 1.95.7 are in use.
2. Rollback or Update: Downgrade to a safe version prior to 1.95.6 or update to version 1.95.8, which was released to remove the injected code.
3. Verify Code: Manually inspect your node_modules directory and dependency trees for suspicious modifications.
4. Revoke Access: Regenerate compromised keys and revoke permissions as needed.

How to Check If Your Application Is Affected

You can use Socket's free tools to check if your code is affected:

• Install Socket and run a scan with the CLI (with socket scan create .). This is an easy way to see if you’re affected in a local repository.
• Install the free Socket for GitHub app, which will let you find out if any repos across your organization are using the affected version (though repos won’t be scanned until there is a new commit in each repo on the default branch).

This is a developing story and we will update as we get more information.

Update:

npm has moved swiftly to remove the affected versions.

12/4/2024 - 6:50PM EST: In a post on Bluesky, Datadog cloud security researcher Christophe Tafani-Dereeper highlighted that the backdoor in v1.95.7 includes an "addToQueue" function designed to exfiltrate private keys using seemingly-legitimate CloudFlare headers.

"This function is strategically injected into various legitimate code paths that access the private key," Tafani-Dereeper explained.

He also noted that the associated domain (sol-rpc[.]xyz) was registered on November 22 via NameSilo and is currently hosted behind CloudFlare, although the C2 is currently down.

Impact of the Supply Chain Attack#

At 6:12PM on December 3, Anza, a Solana focused research and development firm, disclosed that a publish-access account was compromised, allowing the threat actor to steal private key material and drain funds from dapps, like bots, that handle private keys directly.

Anza clarified that the attack should not affect non-custodial wallets, because they don't expose private keys during transactions.

This is not an issue with the Solana protocol itself, but with a specific JavaScript client library and only appears to affect projects that directly handle private keys and that updated within the window of 3:20pm UTC and 8:25pm UTC on Tuesday, December 2, 2024.

Anza recommends developers who suspect they were compromised to rotate any suspect authority keys, including multisigs, program authorities, and server keypairs.

Mert Mumtaz, CEO of Helius Labs, a Solana development tools company, estimated the damage from this attack to be roughly $130K. Decrypt projected the breach led to $160K in stolen assets, including SOL tokens and other crypto assets, based on Solscan data for the hardcoded wallet.

Mumtaz reports that most major wallets and apps were not affected or not using the compromised versions, including Phantom, Backpack, Coinbase, Exodus, and Kamino. Apps that were not blindly upgrading to the latest versions from npm during the few hours when the compromised versions were live, are likely not affected by the incident. These packages were promptly removed from npm to mitigate the damage to developers and apps relying on Solana's web3.js library.