Security researchers have uncovered a targeted supply chain attack aimed at cryptocurrency developers.
Fivemalicious npm packages published by the account “galedonovan” were found to be typosquatting legitimate Solana and Ethereum libraries.
Once installed, these packages secretly steal private keys and send them directly to a threat actor’s Telegram bot.
While one package was quickly unpublished, the campaign remains a severe threat to developers managing digital assets.
How The Attack Works
The malicious packages are designed to look and act like standard crypto tools. They operate by hooking into common functions that developers routinely use to process private keys.
For Solana developers, the malware intercepts calls to the Base58 decode() function. For Ethereum developers, it targets the Wallet constructor within the fake ethersproject-wallet package.
When a developer passes a private key through these functions, the malicious code silently captures it. It then uses the fetch() command to send the key as plaintext to a hardcoded Telegram group.
Because the expected crypto function still completes normally, the application continues running with no visible errors to alert the victim.
base-x-64@0.0.6. The alert correctly identifies the obfuscated exfiltration channel in src/cjs/index.cjs and warns that any data being passed to decode() is sent to a hardcoded Telegram bot (Source: socket)This data theft requires Node.js 18 or newer to execute the network request. On older versions, the theft quietly fails without crashing the application.
All stolen data routes to a single Telegram bot (@Test20131_Bot), which forwards the keys to a private group controlled by a user known as @crypto_sol3.
Because the attack relies entirely on Telegram’s official API for its Command and Control (C2) infrastructure, there are no traditional malicious domains for security tools to block.
getChatAdministrators response queried using the bot token hardcoded in the malware. The group creator – @crypto_sol3, user ID 7847516435 – is the sole human member (Source: socket)Impacted Packages and Mitigation
The campaign consists of five linked packages: raydium-bs58, base-x-64, bs58-basic, ethersproject-wallet, and the briefly published base_xd.
Each package uses varying levels of stealth. For instance, raydium-bs58 is completely visible and even accidentally leaked the attacker’s Telegram invite link in its source code.
In contrast, ethersproject-wallet is highly sophisticated; it perfectly clones a legitimate library and injects a single line of obfuscated malicious code post-compilation.
galedonovan profile showing five published packages. Right: npm registry metadata for base_xd showing publication at 19:03:24Z and an unpublished record at 19:08:30Z – five minutes later. The other four packages by the same author remain live (Source: socket)Meanwhile, bs58-basic contains no malicious code itself. However, it acts as a trap by pulling in the malicious base-x-64 as a hidden transitive dependency.
Security teams linked all five packages to the same threat actor due to shared code typos, identical compiled binaries, matching file timestamps, and the reuse of the same Telegram bot token.
Developers must urgently audit their package.json files. If any of these malicious packages are found, developers should assume all associated private keys socket are compromised. Affected users must immediately move their funds and rotate their keys.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
