Galedonovan npm Crypto-Stealer Campaign (2026)

Summary

Security researchers reported that five npm packages — raydium-bs58, base-x-64, bs58-basic, base_xd, and ethersproject-wallet — were published under an npm account described in press reports as "galedonovan" and used to intercept Solana and Ethereum private keys, sending them to a Telegram bot. npm registry records independently confirm all five packages existed and were malicious, though the registry's own timestamps show the packages were first published between November 2025 and February 2026 and were pulled from the registry on April 1, 2026 — a different timeline than the "March 2026" framing used by some secondary reports. The npm account name, the specific Telegram bot handle, and attribution of discovery to Socket (rather than Amazon Inspector, credited in the official malware advisories) could not be independently confirmed from primary sources.