Author: Thinking Editor: Liz Background Overview On July 2, 2025, a victim contacted the SlowMist security team to seek assistance in analyzing the reasons for the theft of his walletAuthor: Thinking Editor: Liz Background Overview On July 2, 2025, a victim contacted the SlowMist security team to seek assistance in analyzing the reasons for the theft of his wallet

Malicious NPM package steals private keys, Solana user assets are stolen

2025/07/04 12:00
4 min read
For feedback or concerns regarding this content, please contact us at crypto.news@mexc.com

Author: Thinking

Editor: Liz

Background Overview

On July 2, 2025, a victim contacted the SlowMist security team to seek assistance in analyzing the reasons for the theft of his wallet assets. The incident was caused by his use of an open source project hosted on GitHub the day before - zldp2002/solana-pumpfun-bot, and then the encrypted assets were stolen.

Analysis process

We immediately started investigating the incident. We first visited the project's GitHub repository: https://github.com/zldp2002/solana-pumpfun-bot, where we can see that its number of stars and forks is relatively high, but the code submission time under each directory is concentrated in the past three weeks, which is obviously abnormal and lacks the continuous update track that a normal project should have.

Malicious NPM package steals private keys, Solana user assets are stolen

This is a Node.js-based project. We first analyzed its dependent packages and found that it referenced a third-party package called crypto-layout-utils.

Malicious NPM package steals private keys, Solana user assets are stolen

Further verification revealed that the dependency package had been officially removed from NPM, and the version specified in package.json did not appear in the official NPM history. We initially determined that the package was a suspicious component and could no longer be downloaded from the official NPM source. So, how did the victim obtain this malicious dependency?

Malicious NPM package steals private keys, Solana user assets are stolen

Continuing to dig deeper into the project, we found a key clue in the package-lock.json file: the attacker replaced the download link of crypto-layout-utils with: https://github.com/sjaduwhv/testing-dev-log/releases/download/1.3.1/crypto-layout-utils-1.3.1.tgz.

Malicious NPM package steals private keys, Solana user assets are stolen

We downloaded this suspicious dependency package: crypto-layout-utils-1.3.1, and found that it was a highly obfuscated code using jsjiami.com.v7, which increased the difficulty of analysis.

Malicious NPM package steals private keys, Solana user assets are stolen

Malicious NPM package steals private keys, Solana user assets are stolen

After deobfuscation, we confirmed that this is a malicious NPM package. The attacker implemented the logic of scanning the victim's computer files in crypto-layout-utils-1.3.1. If any content or files related to wallets or private keys are found, they will be uploaded to the server controlled by the attacker (githubshadow.xyz).

Malicious NPM package scans for sensitive files and directories:

Malicious NPM package steals private keys, Solana user assets are stolen

Malicious NPM packages upload content or files containing private keys:

Malicious NPM package steals private keys, Solana user assets are stolen

We continue to explore the attack methods. The project author (https://github.com/zldp2002/) is suspected to control a number of GitHub accounts, which are used to fork malicious projects and distribute malicious programs. At the same time, the number of Forks and Stars of the project is increased to attract more users to pay attention, so as to expand the distribution range of malicious programs.

Malicious NPM package steals private keys, Solana user assets are stolen

We also identified multiple Fork projects with similar malicious behavior, some of which used another malicious package bs58-encrypt-utils-1.0.3.

The malicious package was created on June 12, 2025. It is speculated that the attacker had already started distributing malicious NPM and malicious Node.js projects at this time. However, after NPM removed bs58-encrypt-utils, the attacker replaced the NPM package download link for distribution.

Malicious NPM package steals private keys, Solana user assets are stolen

In addition, we used the on-chain anti-money laundering and tracking tool MistTrack to analyze and found that after one of the attacker addresses stole coins, it transferred the funds to the trading platform FixedFloat.

Malicious NPM package steals private keys, Solana user assets are stolen

Summarize

In this attack, the attacker disguised himself as a legitimate open source project (solana-pumpfun-bot) to trick users into downloading and running malicious code. Under the cover of boosting the popularity of the project, users ran the Node.js project with malicious dependencies without any warning, resulting in the leakage of wallet private keys and the theft of assets.

The entire attack chain involves multiple GitHub accounts working together, which expands the scope of dissemination, enhances credibility, and is extremely deceptive. At the same time, this type of attack uses both social engineering and technical means, and it is difficult to fully defend against it within an organization.

We recommend that developers and users be highly vigilant about unknown GitHub projects, especially when it comes to wallet or private key operations. If you really need to run and debug, it is recommended to run and debug in an independent machine environment without sensitive data.

Information about malicious dependency packages

GitHub repository of the malicious Node.js project:

2723799947qq2022/solana-pumpfun-bot

2kwkkk/solana-pumpfun-bot

790659193qqch/solana-pumpfun-bot

7arlystar/solana-pumpfun-bot

918715c83/solana-pumpfun-bot

AmirhBeigi7zch6f/solana-pumpfun-bot

asmaamohamed0264/solana-pumpfun-bot

bog-us/solana-pumpfun-bot

edparker89/solana-pumpfun-bot

ii4272/solana-pumpfun-bot

ijtye/solana-pumpfun-bot

iwanjunaids/solana-pumpfun-bot

janmalece/solana-pumpfun-bot

kay2x4/solana-pumpfun-bot

lan666as2dfur/solana-pumpfun-bot

loveccat/solana-pumpfun-bot

lukgria/solana-pumpfun-bot

mdemetrial26rvk9w/solana-pumpfun-bot

oumengwas/solana-pumpfun-bot

pangxingwaxg/solana-pumpfun-bot

Rain-Rave5/solana-pumpfun-bot

wc64561673347375/solana-pumpfun-bot

wj6942/solana-pumpfun-bot

xnaotutu77765/solana-pumpfun-bot

yvagSirKt/solana-pumpfun-bot

VictorVelea/solana-copy-bot

Morning-Star213/Solana-pumpfun-bot

warp-zara/solana-trading-bot

harshith-eth/quant-bot

Malicious NPM package:

crypto-layout-utils

bs58-encrypt-utils

Malicious NPM package download link:

The server where the malicious NPM package uploads

githubshadow.xyz

Market Opportunity
Ambire Wallet Logo
Ambire Wallet Price(WALLET)
$0.01145
$0.01145$0.01145
+0.43%
USD
Ambire Wallet (WALLET) Live Price Chart
Disclaimer: The articles reposted on this site are sourced from public platforms and are provided for informational purposes only. They do not necessarily reflect the views of MEXC. All rights remain with the original authors. If you believe any content infringes on third-party rights, please contact crypto.news@mexc.com for removal. MEXC makes no guarantees regarding the accuracy, completeness, or timeliness of the content and is not responsible for any actions taken based on the information provided. The content does not constitute financial, legal, or other professional advice, nor should it be considered a recommendation or endorsement by MEXC.

You May Also Like

Lovable AI’s Astonishing Rise: Anton Osika Reveals Startup Secrets at Bitcoin World Disrupt 2025

Lovable AI’s Astonishing Rise: Anton Osika Reveals Startup Secrets at Bitcoin World Disrupt 2025

BitcoinWorld Lovable AI’s Astonishing Rise: Anton Osika Reveals Startup Secrets at Bitcoin World Disrupt 2025 Are you ready to witness a phenomenon? The world of technology is abuzz with the incredible rise of Lovable AI, a startup that’s not just breaking records but rewriting the rulebook for rapid growth. Imagine creating powerful apps and websites just by speaking to an AI – that’s the magic Lovable brings to the masses. This groundbreaking approach has propelled the company into the spotlight, making it one of the fastest-growing software firms in history. And now, the visionary behind this sensation, co-founder and CEO Anton Osika, is set to share his invaluable insights on the Disrupt Stage at the highly anticipated Bitcoin World Disrupt 2025. If you’re a founder, investor, or tech enthusiast eager to understand the future of innovation, this is an event you cannot afford to miss. Lovable AI’s Meteoric Ascent: Redefining Software Creation In an era where digital transformation is paramount, Lovable AI has emerged as a true game-changer. Its core premise is deceptively simple yet profoundly impactful: democratize software creation. By enabling anyone to build applications and websites through intuitive AI conversations, Lovable is empowering the vast majority of individuals who lack coding skills to transform their ideas into tangible digital products. This mission has resonated globally, leading to unprecedented momentum. The numbers speak for themselves: Achieved an astonishing $100 million Annual Recurring Revenue (ARR) in less than a year. Successfully raised a $200 million Series A funding round, valuing the company at $1.8 billion, led by industry giant Accel. Is currently fielding unsolicited investor offers, pushing its valuation towards an incredible $4 billion. As industry reports suggest, investors are unequivocally “loving Lovable,” and it’s clear why. This isn’t just about impressive financial metrics; it’s about a company that has tapped into a fundamental need, offering a solution that is both innovative and accessible. The rapid scaling of Lovable AI provides a compelling case study for any entrepreneur aiming for similar exponential growth. The Visionary Behind the Hype: Anton Osika’s Journey to Innovation Every groundbreaking company has a driving force, and for Lovable, that force is co-founder and CEO Anton Osika. His journey is as fascinating as his company’s success. A physicist by training, Osika previously contributed to the cutting-edge research at CERN, the European Organization for Nuclear Research. This deep technical background, combined with his entrepreneurial spirit, has been instrumental in Lovable’s rapid ascent. Before Lovable, he honed his skills as a co-founder of Depict.ai and a Founding Engineer at Sana. Based in Stockholm, Osika has masterfully steered Lovable from a nascent idea to a global phenomenon in record time. His leadership embodies a unique blend of profound technical understanding and a keen, consumer-first vision. At Bitcoin World Disrupt 2025, attendees will have the rare opportunity to hear directly from Osika about what it truly takes to build a brand that not only scales at an incredible pace in a fiercely competitive market but also adeptly manages the intense cultural conversations that inevitably accompany such swift and significant success. His insights will be crucial for anyone looking to understand the dynamics of high-growth tech leadership. Unpacking Consumer Tech Innovation at Bitcoin World Disrupt 2025 The 20th anniversary of Bitcoin World is set to be marked by a truly special event: Bitcoin World Disrupt 2025. From October 27–29, Moscone West in San Francisco will transform into the epicenter of innovation, gathering over 10,000 founders, investors, and tech leaders. It’s the ideal platform to explore the future of consumer tech innovation, and Anton Osika’s presence on the Disrupt Stage is a highlight. His session will delve into how Lovable is not just participating in but actively shaping the next wave of consumer-facing technologies. Why is this session particularly relevant for those interested in the future of consumer experiences? Osika’s discussion will go beyond the superficial, offering a deep dive into the strategies that have allowed Lovable to carve out a unique category in a market long thought to be saturated. Attendees will gain a front-row seat to understanding how to identify unmet consumer needs, leverage advanced AI to meet those needs, and build a product that captivates users globally. The event itself promises a rich tapestry of ideas and networking opportunities: For Founders: Sharpen your pitch and connect with potential investors. For Investors: Discover the next breakout startup poised for massive growth. For Innovators: Claim your spot at the forefront of technological advancements. The insights shared regarding consumer tech innovation at this event will be invaluable for anyone looking to navigate the complexities and capitalize on the opportunities within this dynamic sector. Mastering Startup Growth Strategies: A Blueprint for the Future Lovable’s journey isn’t just another startup success story; it’s a meticulously crafted blueprint for effective startup growth strategies in the modern era. Anton Osika’s experience offers a rare glimpse into the practicalities of scaling a business at breakneck speed while maintaining product integrity and managing external pressures. For entrepreneurs and aspiring tech leaders, his talk will serve as a masterclass in several critical areas: Strategy Focus Key Takeaways from Lovable’s Journey Rapid Scaling How to build infrastructure and teams that support exponential user and revenue growth without compromising quality. Product-Market Fit Identifying a significant, underserved market (the 99% who can’t code) and developing a truly innovative solution (AI-powered app creation). Investor Relations Balancing intense investor interest and pressure with a steadfast focus on product development and long-term vision. Category Creation Carving out an entirely new niche by democratizing complex technologies, rather than competing in existing crowded markets. Understanding these startup growth strategies is essential for anyone aiming to build a resilient and impactful consumer experience. Osika’s session will provide actionable insights into how to replicate elements of Lovable’s success, offering guidance on navigating challenges from product development to market penetration and investor management. Conclusion: Seize the Future of Tech The story of Lovable, under the astute leadership of Anton Osika, is a testament to the power of innovative ideas meeting flawless execution. Their remarkable journey from concept to a multi-billion-dollar valuation in record time is a compelling narrative for anyone interested in the future of technology. By democratizing software creation through Lovable AI, they are not just building a company; they are fostering a new generation of creators. His appearance at Bitcoin World Disrupt 2025 is an unmissable opportunity to gain direct insights from a leader who is truly shaping the landscape of consumer tech innovation. Don’t miss this chance to learn about cutting-edge startup growth strategies and secure your front-row seat to the future. Register now and save up to $668 before Regular Bird rates end on September 26. To learn more about the latest AI market trends, explore our article on key developments shaping AI features. This post Lovable AI’s Astonishing Rise: Anton Osika Reveals Startup Secrets at Bitcoin World Disrupt 2025 first appeared on BitcoinWorld.
Share
Coinstats2025/09/17 23:40
This New Crypto Is Selling Rapidly as Whales Accumulate Before It Hits $0.06

This New Crypto Is Selling Rapidly as Whales Accumulate Before It Hits $0.06

The crypto market is once again entering a phase where early positioning is becoming critical. As investors search for the best crypto to buy now, attention is
Share
Techbullion2026/04/05 19:52
Next Crypto to Explode: Altcoin Season Jumps as Pepeto Targets 100x

Next Crypto to Explode: Altcoin Season Jumps as Pepeto Targets 100x

The Altcoin Season Index climbed 30 points in one week to 52, and Solana meme coin DEX volume hit $87.8 billion weekly, proving speculative capital rotates back
Share
Techbullion2026/04/05 20:43

$30,000 in PRL + 15,000 USDT

$30,000 in PRL + 15,000 USDT$30,000 in PRL + 15,000 USDT

Deposit & trade PRL to boost your rewards!