Author: Thinking Editor: Liz Background Overview On July 2, 2025, a victim contacted the SlowMist security team to seek assistance in analyzing the reasons for the theft of his walletAuthor: Thinking Editor: Liz Background Overview On July 2, 2025, a victim contacted the SlowMist security team to seek assistance in analyzing the reasons for the theft of his wallet

Malicious NPM package steals private keys, Solana user assets are stolen

2025/07/04 12:00

Author: Thinking

Editor: Liz

Background Overview

On July 2, 2025, a victim contacted the SlowMist security team to seek assistance in analyzing the reasons for the theft of his wallet assets. The incident was caused by his use of an open source project hosted on GitHub the day before - zldp2002/solana-pumpfun-bot, and then the encrypted assets were stolen.

Analysis process

We immediately started investigating the incident. We first visited the project's GitHub repository: https://github.com/zldp2002/solana-pumpfun-bot, where we can see that its number of stars and forks is relatively high, but the code submission time under each directory is concentrated in the past three weeks, which is obviously abnormal and lacks the continuous update track that a normal project should have.

Malicious NPM package steals private keys, Solana user assets are stolen

This is a Node.js-based project. We first analyzed its dependent packages and found that it referenced a third-party package called crypto-layout-utils.

Malicious NPM package steals private keys, Solana user assets are stolen

Further verification revealed that the dependency package had been officially removed from NPM, and the version specified in package.json did not appear in the official NPM history. We initially determined that the package was a suspicious component and could no longer be downloaded from the official NPM source. So, how did the victim obtain this malicious dependency?

Malicious NPM package steals private keys, Solana user assets are stolen

Continuing to dig deeper into the project, we found a key clue in the package-lock.json file: the attacker replaced the download link of crypto-layout-utils with: https://github.com/sjaduwhv/testing-dev-log/releases/download/1.3.1/crypto-layout-utils-1.3.1.tgz.

Malicious NPM package steals private keys, Solana user assets are stolen

We downloaded this suspicious dependency package: crypto-layout-utils-1.3.1, and found that it was a highly obfuscated code using jsjiami.com.v7, which increased the difficulty of analysis.

Malicious NPM package steals private keys, Solana user assets are stolen

Malicious NPM package steals private keys, Solana user assets are stolen

After deobfuscation, we confirmed that this is a malicious NPM package. The attacker implemented the logic of scanning the victim's computer files in crypto-layout-utils-1.3.1. If any content or files related to wallets or private keys are found, they will be uploaded to the server controlled by the attacker (githubshadow.xyz).

Malicious NPM package scans for sensitive files and directories:

Malicious NPM package steals private keys, Solana user assets are stolen

Malicious NPM packages upload content or files containing private keys:

Malicious NPM package steals private keys, Solana user assets are stolen

We continue to explore the attack methods. The project author (https://github.com/zldp2002/) is suspected to control a number of GitHub accounts, which are used to fork malicious projects and distribute malicious programs. At the same time, the number of Forks and Stars of the project is increased to attract more users to pay attention, so as to expand the distribution range of malicious programs.

Malicious NPM package steals private keys, Solana user assets are stolen

We also identified multiple Fork projects with similar malicious behavior, some of which used another malicious package bs58-encrypt-utils-1.0.3.

The malicious package was created on June 12, 2025. It is speculated that the attacker had already started distributing malicious NPM and malicious Node.js projects at this time. However, after NPM removed bs58-encrypt-utils, the attacker replaced the NPM package download link for distribution.

Malicious NPM package steals private keys, Solana user assets are stolen

In addition, we used the on-chain anti-money laundering and tracking tool MistTrack to analyze and found that after one of the attacker addresses stole coins, it transferred the funds to the trading platform FixedFloat.

Malicious NPM package steals private keys, Solana user assets are stolen

Summarize

In this attack, the attacker disguised himself as a legitimate open source project (solana-pumpfun-bot) to trick users into downloading and running malicious code. Under the cover of boosting the popularity of the project, users ran the Node.js project with malicious dependencies without any warning, resulting in the leakage of wallet private keys and the theft of assets.

The entire attack chain involves multiple GitHub accounts working together, which expands the scope of dissemination, enhances credibility, and is extremely deceptive. At the same time, this type of attack uses both social engineering and technical means, and it is difficult to fully defend against it within an organization.

We recommend that developers and users be highly vigilant about unknown GitHub projects, especially when it comes to wallet or private key operations. If you really need to run and debug, it is recommended to run and debug in an independent machine environment without sensitive data.

Information about malicious dependency packages

GitHub repository of the malicious Node.js project:

2723799947qq2022/solana-pumpfun-bot

2kwkkk/solana-pumpfun-bot

790659193qqch/solana-pumpfun-bot

7arlystar/solana-pumpfun-bot

918715c83/solana-pumpfun-bot

AmirhBeigi7zch6f/solana-pumpfun-bot

asmaamohamed0264/solana-pumpfun-bot

bog-us/solana-pumpfun-bot

edparker89/solana-pumpfun-bot

ii4272/solana-pumpfun-bot

ijtye/solana-pumpfun-bot

iwanjunaids/solana-pumpfun-bot

janmalece/solana-pumpfun-bot

kay2x4/solana-pumpfun-bot

lan666as2dfur/solana-pumpfun-bot

loveccat/solana-pumpfun-bot

lukgria/solana-pumpfun-bot

mdemetrial26rvk9w/solana-pumpfun-bot

oumengwas/solana-pumpfun-bot

pangxingwaxg/solana-pumpfun-bot

Rain-Rave5/solana-pumpfun-bot

wc64561673347375/solana-pumpfun-bot

wj6942/solana-pumpfun-bot

xnaotutu77765/solana-pumpfun-bot

yvagSirKt/solana-pumpfun-bot

VictorVelea/solana-copy-bot

Morning-Star213/Solana-pumpfun-bot

warp-zara/solana-trading-bot

harshith-eth/quant-bot

Malicious NPM package:

crypto-layout-utils

bs58-encrypt-utils

Malicious NPM package download link:

The server where the malicious NPM package uploads data:

githubshadow.xyz

Market Opportunity
Ambire Wallet Logo
Ambire Wallet Price(WALLET)
$0,01365
$0,01365$0,01365
-%11,82
USD
Ambire Wallet (WALLET) Live Price Chart
Disclaimer: The articles reposted on this site are sourced from public platforms and are provided for informational purposes only. They do not necessarily reflect the views of MEXC. All rights remain with the original authors. If you believe any content infringes on third-party rights, please contact service@support.mexc.com for removal. MEXC makes no guarantees regarding the accuracy, completeness, or timeliness of the content and is not responsible for any actions taken based on the information provided. The content does not constitute financial, legal, or other professional advice, nor should it be considered a recommendation or endorsement by MEXC.

You May Also Like

More On-Chain Activity as Over 131,000 Cardano Transactions Feature NIGHT Tokens

More On-Chain Activity as Over 131,000 Cardano Transactions Feature NIGHT Tokens

The launch of NIGHT, the native token of Midnight, has significantly impacted the number of transactions across the broader Cardano ecosystem. Cardano founder Charles
Share
Coinstats2025/12/18 15:13
What is Ethereum’s Fusaka Upgrade? Everything You Need to Know

What is Ethereum’s Fusaka Upgrade? Everything You Need to Know

Over the past few weeks, one of the most talked-about topics within the crypto community has been Ethereum’s Fusaka upgrade. What exactly is this upgrade, and how does it affect the Ethereum blockchain and the average crypto investor? This article will be the only explainer guide you need to understand the details of this upgrade within the Ethereum ecosystem. Why Does Ethereum Undergo Upgrades? To understand what the Fusaka upgrade will achieve, it is essential to comprehend what Ethereum’s upgrades aim to accomplish. The layer-1 Ethereum network was originally designed as a proof-of-work (PoW) blockchain. This implied that miners were actively behind the block mining process. While this consensus mechanism ensured security for the L1 blockchain, it also triggered slower transactions. The Ethereum development team unveiled a detailed roadmap, outlining various upgrades that will fix most of the network’s issues. These problems include its scalability issue, which refers to the network’s ability to process transactions faster. Currently, the Ethereum blockchain processes fewer transactions per second compared to most blockchains using the proof-of-stake (PoS) consensus mechanism. Over the past decade, Ethereum’s developers have implemented most of these upgrades, enhancing the blockchain’s overall performance. Here is a list of the upgrades that Ethereum has undergone: Frontier: July 2015 Frontier Thawing: September 2015 Homestead: March 2016 DAO Fork: July 2016 Tangerine Whistle: October 2016 Spurious Dragon: November 2016 Byzantium: October 2017 Constantinople: February 2019 Petersburg: February 2019 Istanbul: December 2019 Muir Glacier: January 2020 Berlin: April 2021 London: August 2021 Arrow Glacier: December 2021 Gray Glacier: June 2022 The Merge: September 2022 Bellatrix: September 2022 Paris: September 2022 Shanghai: April 2023 Capella: April 2023 Dencun (Cancun-Deneb): March 2024 Pectra (Prague-Electra): May 2025 Most of these upgrades (forks) addressed various Ethereum Improvement Proposals (EIPs) geared towards driving the blockchain’s growth. For instance, the Merge enabled the transition from the PoW model to a proof of stake (PoS) algorithm. This brought staking and network validators into the Ethereum mainnet. Still, this upgrade failed to unlock the much-needed scalability. For most of Ethereum’s existence, it has housed layer-2 networks, which leverage Ethereum’s infrastructure to tackle the scalability issue. While benefiting from the L1 blockchain’s security and decentralization, these L2 networks enable users to execute lightning-fast transactions. Last year’s Dencun upgrade made transacting on layer-2 networks even easier with the introduction of proto-danksharding (EIP-4844). Poised to address the scalability issue, this upgrade introduces data blobs. You can think of these blobs as temporary, large data containers that enable cheaper, yet temporary, storage of transactions on L2 networks. The effect? It reduces gas fees, facilitating cheaper transaction costs on these L2 rollups. The Pectra upgrade, unveiled earlier this year, also included EIPs addressing the scalability issue plaguing the Ethereum ecosystem. The upcoming upgrade, Fusaka, will help the decade-old blockchain network to become more efficient by improving the blob capacity. What is Ethereum’s Fusaka Upgrade? Fusaka is an upgrade that addresses Ethereum’s scalability issue, thereby making the blockchain network more efficient. As mentioned earlier, Fusaka will bolster the blob capacity for layer-2 blockchains, which refers to the amount of temporary data the network can process. This will help facilitate faster transactions on these L2 scaling solutions. It is worth noting that upon Fusaka’s completion, users will be able to save more when performing transactions across layer-2 networks like Polygon, Arbitrum, and Base. The upgrade has no direct positive impact on the L1 blockchain itself. On September 18th, Christine Kim, representing Ethereum core developers, confirmed the launch date for Fusaka via an X post. Following an All Core Developers Consensus (ACDC) call, the developer announced that the Ethereum Fusaka upgrade will take place on December 3rd. Ahead of the upgrade, there will be three public testnets. Fusaka will first be deployed on Holesky around October 1st. If that goes smoothly, it will move to Sepolia on October 14th. Finally, it will be on the Hoodi testnet on October 28th. Each stage provides developers and node operators with an opportunity to identify and address bugs, run stress tests, and verify that the network can effectively handle the new features. Running through all three testnets ensures that by the time the upgrade is ready for mainnet, it will have been thoroughly tested in different environments. Crucial to the Fusaka upgrade are the Blob Parameter Only (BPO) forks, which will enhance the blob capacity without requiring end-users of the blockchain network to undergo any software changes. For several months, the Ethereum development team has been working towards unveiling the BPO-1 and BPO-2 forks. Blockchain developers have pooled resources to develop Fusaka through devnets. Following performances from devnet-5, developers within the ecosystem confirmed that the BPO upgrades will come shortly after the Fusaka mainnet debut. Approximately two weeks after the mainnet launch, on December 17th, the BPO-1 fork will increase the blob target/max from 6/9 to 10/15. Then, two weeks later, on January 7th, 2026, the BPO-2 fork is expected to expand capacity further to a metric of 14/21. Ultimately, the Fusaka upgrade would have doubled the blob capacity, marking a pivotal move for the Ethereum ecosystem. Impact on the Ethereum Ecosystem Admittedly, the Ethereum ecosystem is expected to see more developers and users join the bandwagon. With the introduction of faster and cheaper transactions, developers and business owners can explore more efficient ways to build on the L1 blockchain. This means we can see initiatives like crypto payment solutions and more decentralized finance (DeFi) projects enter the Ethereum bandwagon. Users, on the other hand, will benefit as they execute cheaper on-chain transactions. Despite the benefits from this initiative, some in the crypto community worry about the reduction in Ethereum’s gwei (the smallest unit of the Ether coin). Shortly after the Dencun upgrade, Ethereum’s median gas fee dropped to 1.7 gwei. Fast-forward to the present, and the median gas fee sits at 0.41 gwei, according to public data on Dune. This drop hints at the drastic reduction in gas fees, which could affect those staking their crypto holdings on the L1 blockchain, making it less attractive to stakers. Since the Fusaka upgrade aims to reduce the L2 network gas fee further, some observers may worry that crypto stakers will receive fewer block rewards. Time will tell if the Ethereum development team will explore new incentives for those participating in staking. Will Ether’s Price Pump? There is no guarantee that Ether (ETH) will jump following Fusaka’s launch in December. This is because the second-largest cryptocurrency saw no significant price movement during past major upgrades. According to data from CoinMarketCap, ETH sold for approximately $4,400 at the time of writing. Notably, the coin saw its current all-time high (ATH) of $4,900 roughly a month ago. The price pump was fueled by consistent Ether acquisitions by exchange-traded fund (ETF) buyers and crypto treasury firms. Source: CoinMarketCap Although these upgrades do not guarantee a surge in ETH’s price, they have a lasting impact on the underlying Ethereum blockchain. Conclusion Over the past 10 years, the Ethereum network has had no rest as it constantly ships out new upgrades to make its mainnet more scalable. The Fusaka upgrade aims to make Ethereum layer-2 networks cheaper to use. To ensure its smooth usage, several testnets are lined up. Stay tuned for updates on how Ethereum will be post-Fusaka. The post What is Ethereum’s Fusaka Upgrade? Everything You Need to Know appeared first on Cointab.
Share
Coinstats2025/09/20 06:57
Vitalik Buterin Suggests Simplifying Ethereum to Boost User Understanding

Vitalik Buterin Suggests Simplifying Ethereum to Boost User Understanding

The post Vitalik Buterin Suggests Simplifying Ethereum to Boost User Understanding appeared on BitcoinEthereumNews.com. Ethereum trustlessness requires broader
Share
BitcoinEthereumNews2025/12/18 15:13