Solana users encounter Private Key theft incident, malicious NPM package becomes the culprit

In early July 2025, a theft incident targeting Solana users caught the attention of security experts. The incident originated from the victim using an open-source project hosted on GitHub called solana-pumpfun-bot, after which their crypto assets were stolen.

After the security team conducted an investigation, it was found that although the project had a high number of Stars and Forks, the code submission times were unusually concentrated, lacking the characteristics of continuous updates. Further analysis revealed that the project relied on a suspicious third-party package crypto-layout-utils, which has been removed from NPM by the official.

Investigators found that the attacker replaced the download link for crypto-layout-utils in the package-lock.json file with a version from a GitHub repository. This version is highly obfuscated and is actually a malicious NPM package that can scan sensitive files on the user's computer and upload content containing Private Key to a server controlled by the attacker.

The attacker may also have controlled multiple GitHub accounts to fork malicious projects and enhance their credibility. In addition to crypto-layout-utils, another malicious package named bs58-encrypt-utils was found to be involved in the attack.

Through on-chain analysis tools, the security team traced some of the stolen funds to a certain trading platform.

This incident highlights the hidden security risks in open-source projects. Attackers disguise themselves as legitimate projects and successfully lure users into running code with malicious dependencies through social engineering and technical means, resulting in private key leaks and asset losses.

Security experts advise developers and users to remain highly vigilant about unknown GitHub projects, especially when it involves wallet or Private Key operations. If debugging is necessary, it is best to do so in a separate environment without sensitive data.

This incident involves multiple malicious GitHub repositories and NPM packages, and the security team has compiled relevant information for reference. As attack methods continue to evolve, users should exercise extra caution when using open-source projects to guard against potential security threats.