ExchangeDEX+
Buy CryptoMarketsSpotFuturesGOLDEarnEvents
More
Author: Thinking Editor: Liz Background Overview On July 2, 2025, a victim contacted the SlowMist security team to seek assistance in analyzing the reasons for the theft of his walletAuthor: Thinking Editor: Liz Background Overview On July 2, 2025, a victim contacted the SlowMist security team to seek assistance in analyzing the reasons for the theft of his wallet

Malicious NPM package steals private keys, Solana user assets are stolen

Author: PANewsSource: PANews
2025/07/04 12:00
4 min read
Ambire Wallet
WALLET$0.00951-2.86%

Author: Thinking

Editor: Liz

Background Overview

On July 2, 2025, a victim contacted the SlowMist security team to seek assistance in analyzing the reasons for the theft of his wallet assets. The incident was caused by his use of an open source project hosted on GitHub the day before - zldp2002/solana-pumpfun-bot, and then the encrypted assets were stolen.

Analysis process

We immediately started investigating the incident. We first visited the project's GitHub repository: https://github.com/zldp2002/solana-pumpfun-bot, where we can see that its number of stars and forks is relatively high, but the code submission time under each directory is concentrated in the past three weeks, which is obviously abnormal and lacks the continuous update track that a normal project should have.

Malicious NPM package steals private keys, Solana user assets are stolen

This is a Node.js-based project. We first analyzed its dependent packages and found that it referenced a third-party package called crypto-layout-utils.

Malicious NPM package steals private keys, Solana user assets are stolen

Further verification revealed that the dependency package had been officially removed from NPM, and the version specified in package.json did not appear in the official NPM history. We initially determined that the package was a suspicious component and could no longer be downloaded from the official NPM source. So, how did the victim obtain this malicious dependency?

Malicious NPM package steals private keys, Solana user assets are stolen

Continuing to dig deeper into the project, we found a key clue in the package-lock.json file: the attacker replaced the download link of crypto-layout-utils with: https://github.com/sjaduwhv/testing-dev-log/releases/download/1.3.1/crypto-layout-utils-1.3.1.tgz.

Malicious NPM package steals private keys, Solana user assets are stolen

We downloaded this suspicious dependency package: crypto-layout-utils-1.3.1, and found that it was a highly obfuscated code using jsjiami.com.v7, which increased the difficulty of analysis.

Malicious NPM package steals private keys, Solana user assets are stolen

Malicious NPM package steals private keys, Solana user assets are stolen

After deobfuscation, we confirmed that this is a malicious NPM package. The attacker implemented the logic of scanning the victim's computer files in crypto-layout-utils-1.3.1. If any content or files related to wallets or private keys are found, they will be uploaded to the server controlled by the attacker (githubshadow.xyz).

Malicious NPM package scans for sensitive files and directories:

Malicious NPM package steals private keys, Solana user assets are stolen

Malicious NPM packages upload content or files containing private keys:

Malicious NPM package steals private keys, Solana user assets are stolen

We continue to explore the attack methods. The project author (https://github.com/zldp2002/) is suspected to control a number of GitHub accounts, which are used to fork malicious projects and distribute malicious programs. At the same time, the number of Forks and Stars of the project is increased to attract more users to pay attention, so as to expand the distribution range of malicious programs.

Malicious NPM package steals private keys, Solana user assets are stolen

We also identified multiple Fork projects with similar malicious behavior, some of which used another malicious package bs58-encrypt-utils-1.0.3.

The malicious package was created on June 12, 2025. It is speculated that the attacker had already started distributing malicious NPM and malicious Node.js projects at this time. However, after NPM removed bs58-encrypt-utils, the attacker replaced the NPM package download link for distribution.

Malicious NPM package steals private keys, Solana user assets are stolen

In addition, we used the on-chain anti-money laundering and tracking tool MistTrack to analyze and found that after one of the attacker addresses stole coins, it transferred the funds to the trading platform FixedFloat.

Malicious NPM package steals private keys, Solana user assets are stolen

Summarize

In this attack, the attacker disguised himself as a legitimate open source project (solana-pumpfun-bot) to trick users into downloading and running malicious code. Under the cover of boosting the popularity of the project, users ran the Node.js project with malicious dependencies without any warning, resulting in the leakage of wallet private keys and the theft of assets.

The entire attack chain involves multiple GitHub accounts working together, which expands the scope of dissemination, enhances credibility, and is extremely deceptive. At the same time, this type of attack uses both social engineering and technical means, and it is difficult to fully defend against it within an organization.

We recommend that developers and users be highly vigilant about unknown GitHub projects, especially when it comes to wallet or private key operations. If you really need to run and debug, it is recommended to run and debug in an independent machine environment without sensitive data.

Information about malicious dependency packages

GitHub repository of the malicious Node.js project:

2723799947qq2022/solana-pumpfun-bot

2kwkkk/solana-pumpfun-bot

790659193qqch/solana-pumpfun-bot

7arlystar/solana-pumpfun-bot

918715c83/solana-pumpfun-bot

AmirhBeigi7zch6f/solana-pumpfun-bot

asmaamohamed0264/solana-pumpfun-bot

bog-us/solana-pumpfun-bot

edparker89/solana-pumpfun-bot

ii4272/solana-pumpfun-bot

ijtye/solana-pumpfun-bot

iwanjunaids/solana-pumpfun-bot

janmalece/solana-pumpfun-bot

kay2x4/solana-pumpfun-bot

lan666as2dfur/solana-pumpfun-bot

loveccat/solana-pumpfun-bot

lukgria/solana-pumpfun-bot

mdemetrial26rvk9w/solana-pumpfun-bot

oumengwas/solana-pumpfun-bot

pangxingwaxg/solana-pumpfun-bot

Rain-Rave5/solana-pumpfun-bot

wc64561673347375/solana-pumpfun-bot

wj6942/solana-pumpfun-bot

xnaotutu77765/solana-pumpfun-bot

yvagSirKt/solana-pumpfun-bot

VictorVelea/solana-copy-bot

Morning-Star213/Solana-pumpfun-bot

warp-zara/solana-trading-bot

harshith-eth/quant-bot

Malicious NPM package:

crypto-layout-utils

bs58-encrypt-utils

Malicious NPM package download link:

The server where the malicious NPM package uploads data:

githubshadow.xyz

Market Opportunity
Ambire Wallet Logo
Ambire Wallet Price(WALLET)
$0.00951
$0.00951$0.00951
0.00%
USD
Ambire Wallet (WALLET) Live Price Chart
Disclaimer: The articles reposted on this site are sourced from public platforms and are provided for informational purposes only. They do not necessarily reflect the views of MEXC. All rights remain with the original authors. If you believe any content infringes on third-party rights, please contact service@support.mexc.com for removal. MEXC makes no guarantees regarding the accuracy, completeness, or timeliness of the content and is not responsible for any actions taken based on the information provided. The content does not constitute financial, legal, or other professional advice, nor should it be considered a recommendation or endorsement by MEXC.

You May Also Like

Trading time: Tonight, the US GDP and the upcoming non-farm data will become the market focus. Institutions are bullish on BTC to $120,000 in the second quarter.

Trading time: Tonight, the US GDP and the upcoming non-farm data will become the market focus. Institutions are bullish on BTC to $120,000 in the second quarter.

Daily market key data review and trend analysis, produced by PANews.
Share
PANews2025/04/30 13:50
Ethereum Fusaka Upgrade Set for December 3 Mainnet Launch, Blob Capacity to Double

Ethereum Fusaka Upgrade Set for December 3 Mainnet Launch, Blob Capacity to Double

Ethereum developers confirmed the Fusaka upgrade will activate on mainnet on December 3, 2025, following a systematic testnet rollout beginning on October 1 on Holesky. The major hard fork will implement around 11-12 Ethereum Improvement Proposals targeting scalability, node efficiency, and data availability improvements without adding new user-facing features. According to Christine Kim, the upgrade introduces a phased blob capacity expansion through Blob Parameter Only forks occurring two weeks after Fusaka activation. Initially maintaining current blob limits of 6/9 target/max, the first BPO fork will increase capacity to 10/15 blobs one week later. A second BPO fork will further expand limits to 14/21 blobs, more than doubling total capacity within two weeks. Strategic Infrastructure Overhaul Fusaka prioritizes backend protocol improvements over user-facing features, focusing on making Ethereum faster and less resource-intensive. The upgrade includes PeerDAS implementation through EIP-7594, allowing validator nodes to verify data by sampling small pieces rather than downloading entire blobs. This reduces bandwidth and storage requirements while enhancing Layer 2 rollup scalability. The upgrade builds on recent gas limit increases from 30 million to 45 million gas, with ongoing discussions for further expansion. EIP-7935 proposes increasing limits to 150 million gas, potentially enabling significantly higher transaction throughput. These improvements complement broader scalability efforts, including EIP-9698, which suggests a 100x gas limit increase over two years to reach 2,000 transactions per second. Fusaka removes the previously planned EVM Object Format redesign to reduce complexity while maintaining focus on essential infrastructure improvements. The upgrade introduces bounded base fees for blob transactions via EIP-7918, creating more predictable transaction costs for data-heavy applications. Enhanced spam resistance and security improvements strengthen network resilience against scalability bottlenecks and attacks. Technical Implementation and Testing Timeline The Fusaka rollout follows a conservative four-phase approach across Ethereum testnets before mainnet deployment. Holesky upgrade occurs October 1, followed by Sepolia on October 14 and Hoodi on October 28. Each testnet will undergo the complete BPO fork sequence to validate the blob capacity expansion mechanism. BPO forks activate automatically based on predetermined epochs rather than requiring separate hard fork processes. On mainnet, the first BPO fork launches December 17, increasing blob capacity to 10/15 target/max. The second BPO fork activates January 7, 2026, reaching the final capacity of 14/21 blobs. This automated approach enables flexible blob scaling without requiring full network upgrades. Notably, node operators face release deadlines ranging from September 25 for Holesky to November 3 for mainnet preparation. The staggered timeline, according to the developers, allows comprehensive testing while giving infrastructure providers sufficient preparation time. Speculatively, the developers use this backward-compatible approach to ensure smooth transitions with minimal disruption to existing applications. PeerDAS implementation reduces node resource demands, potentially increasing network decentralization by lowering barriers for smaller operators. The technology enables more efficient data availability sampling, crucial for supporting growing Layer 2 rollup adoption. Overall, these improvements, combined with increased gas limits, will enable Ethereum to handle higher transaction volumes while maintaining security guarantees. Addressing Network Scalability Pressures The Fusaka upgrade addresses mounting pressure for Ethereum base layer improvements amid criticism of Layer 2 fragmentation strategies. Critics argue that reliance on rollups has created isolated chains with limited interoperability, complicating user experiences. The upgrade’s focus on infrastructure improvements aims to enhance base layer capacity while supporting continued Layer 2 growth. The recent validator queue controversy particularly highlights ongoing network scalability challenges. According to a Cryptonews report covered yesterday, currently, over 2M ETH sits in exit queues facing 43-day delays, while entry queues process in just 7 days.Ethereum Validator Queue (Source: ValidatorQueue) However, Vitalik Buterin defended these delays as essential for network security, comparing validator commitments to military service requiring “friction in quitting.” The upgrade coincides with growing institutional interest in Ethereum infrastructure, with VanEck predicting that Layer 2 networks could reach $1 trillion market capitalization within six years. Fusaka’s emphasis on data availability and node efficiency supports Ethereum’s evolution toward seamless cross-chain interoperability. The upgrade complements initiatives like the Open Intents Framework, where Coinbase Payments recently joined as a core contributor. The initiative, if successful, will address the $21B surge in cross-chain crime. These coordinated efforts aim to unify the fragmented multichain experience while maintaining Ethereum’s security and decentralization principles
Share
CryptoNews2025/09/19 16:37
VectorUSA Achieves Fortinet’s Engage Preferred Services Partner Designation

VectorUSA Achieves Fortinet’s Engage Preferred Services Partner Designation

TORRANCE, Calif., Feb. 3, 2026 /PRNewswire/ — VectorUSA, a trusted technology solutions provider, specializes in delivering integrated IT, security, and infrastructure
Share
AI Journal2026/02/05 00:02