Description
Earlier today, a publish-access account was compromised for @solana/web3.js, a JavaScript library that is commonly used by Solana dapps. This allowed an attacker to publish unauthorized and malicious packages that were modified, allowing them to steal private key material and drain funds from dapps, like bots, that handle private keys directly.
Recommendation
Update the @solana/web3.js package to the latest compatible version. Followings are version details:
- Affected version(s): >= 1.95.6, < 1.95.8
- Patched version(s): 1.95.8
References
Could your website be exposed too?
SmartScanner can check your website for Modified package published to npm, containing malware that exfiltrates private key material and gives you actionable findings to investigate.
Start a free scanRelated Issues
- tiny-secp256k1 vulnerable to private key extraction when signing a malicious JSON-stringifyable message in bundled envir - CVE-2024-49364
- ReDoS vulnerability in vue package that is exploitable through inefficient regex evaluation in the parseHTML function - CVE-2024-9506
- secp256k1-node allows private key extraction over ECDH - CVE-2024-48930
- OneUptime Vulnerable to a Privilege Escalation via Local Storage Key Manipulation - CVE-2024-29194
You might also like:
See something that needs correcting? Let us knowUpdated January 22, 2026