Verify a decision

{"actor":"system:backfill","investigation_id":"4de9d9b1-5324-4801-b1cb-23db0ce025dd","kind":"publish","page_slug":"solana-web3-js-supply-chain-attack-december-2024","published_at":"2026-10-13T05:05:47.097Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"@solana/web3.js Supply-Chain Attack (December 2024)","sections":[{"content":"According to Anza's root cause analysis, a member of the @solana npm organization with publish access clicked a spear-phishing email on December 3, 2024, around 3:20pm UTC. The email invited the recipient to a private package and appeared to come from a teammate; the link led to a cloned npm login page where the victim entered credentials and a 2FA code. Malicious versions 1.95.6 and 1.95.7 were then published. Reporting by The Hacker News and The Register states that version 1.95.7 added an 'addToQueue' function that exfiltrated private keys disguised as Cloudflare headers, as analyzed by Datadog's Christophe Tafani-Dereeper. The command-and-control domain was reported as sol-rpc[.]xyz, registered on November 22, 2024 (per The Hacker News). The vulnerability was assigned CVE-2024-54134 (CVSS 8.3) according to The Hacker News and The Register. The identity of the attacker is unknown; Wiz lists the threat actor as unknown.","heading":"Incident overview and mechanism","severity":"critical","sources":[{"credibility":1,"name":"Anza: web3.js exploit root cause analysis","type":"official","url":"https://www.anza.xyz/blog/web3-js-exploit-root-cause-analysis"},{"credibility":2,"name":"The Hacker News: Researchers uncover backdoor in Solana's web3.js","type":"news_article","url":"https://thehackernews.com/2024/12/researchers-uncover-backdoor-in-solanas.html"},{"credibility":1,"name":"The Register: Solana JavaScript SDK compromised","type":"news_article","url":"https://www.theregister.com/2024/12/05/solana_javascript_sdk_compromised/"},{"credibility":2,"name":"Wiz Threats: Solana web3.js supply chain attack","type":"research","url":"https://threats.wiz.io/all-incidents/solana-web3js-supply-chain-attack"}]},{"content":"The library was reported to receive roughly 400,000 to 450,000 weekly downloads. Exposure was limited to projects that handled private keys directly (for example backend JavaScript bots) and installed the malicious versions; maintainers and press reports stated non-custodial wallets should not be affected. Loss figures differ between sources and are not independently reconciled here: The Register quotes Helius Labs CEO Mert Mumtaz estimating 'roughly 130K USD so far' (a single-source estimate); The Hacker News reports unauthorized transfers of $164,100 (674.86 SOL) to an attacker-controlled wallet citing Solscan and Solana Explorer; Wiz reports over $190,000. Infosecurity Magazine reportedly gave a $130,000 to $160,000 range per a search summary, not directly fetched. Sources also disagree on the exposure window date: The Register states 3:20pm to 8:25pm UTC on December 3, 2024, consistent with Anza's timeline, while The Hacker News gives December 2, 2024. The Anza primary source is treated as authoritative for December 3.","heading":"Scope, exposure and reported losses","severity":"high","sources":[{"credibility":1,"name":"The Register: Solana JavaScript SDK compromised","type":"news_article","url":"https://www.theregister.com/2024/12/05/solana_javascript_sdk_compromised/"},{"credibility":2,"name":"The Hacker News: Researchers uncover backdoor in Solana's web3.js","type":"news_article","url":"https://thehackernews.com/2024/12/researchers-uncover-backdoor-in-solanas.html"},{"credibility":2,"name":"Wiz Threats: Solana web3.js supply chain attack","type":"research","url":"https://threats.wiz.io/all-incidents/solana-web3js-supply-chain-attack"},{"credibility":1,"name":"Anza: web3.js exploit root cause analysis","type":"official","url":"https://www.anza.xyz/blog/web3-js-exploit-root-cause-analysis"}]},{"content":"Per Anza, the publishing account's npm credentials were revoked at 7:30pm UTC on December 3 after an engineer began investigating a report of a malicious install. Version 1.95.5 was restored as latest, clean version 1.95.8 was published at 8:25pm UTC, and 1.95.6 and 1.95.7 were deprecated and later removed from the npm registry around 12:22am UTC on December 4. A GitHub security advisory was published and npm access was reissued through revocable, granular tokens. Users who may have installed the affected versions were advised to upgrade to 1.95.8 and rotate any suspect authority keys. Wiz and The Hacker News report the C2 server was taken down.","heading":"Response and remediation","severity":"medium","sources":[{"credibility":1,"name":"Anza: web3.js exploit root cause analysis","type":"official","url":"https://www.anza.xyz/blog/web3-js-exploit-root-cause-analysis"},{"credibility":2,"name":"The Hacker News: Researchers uncover backdoor in Solana's web3.js","type":"news_article","url":"https://thehackernews.com/2024/12/researchers-uncover-backdoor-in-solanas.html"}]},{"content":"No attribution to a named actor was found in the sources reviewed. A formal Helius post-mortem with a loss breakdown was not located. The CVE identifier appears in The Hacker News and The Register but is not listed by Wiz. The GitHub advisory ID differs between secondary mentions, so it is not cited here.","heading":"Limitations of available information","severity":"low","sources":[{"credibility":2,"name":"Wiz Threats: Solana web3.js supply chain attack","type":"research","url":"https://threats.wiz.io/all-incidents/solana-web3js-supply-chain-attack"}]}],"sources_used":[{"credibility":1,"name":"Anza: web3.js exploit root cause analysis","type":"official","url":"https://www.anza.xyz/blog/web3-js-exploit-root-cause-analysis"},{"credibility":1,"name":"The Register: Solana JavaScript SDK compromised","type":"news_article","url":"https://www.theregister.com/2024/12/05/solana_javascript_sdk_compromised/"},{"credibility":2,"name":"The Hacker News: Researchers uncover backdoor in Solana's web3.js","type":"news_article","url":"https://thehackernews.com/2024/12/researchers-uncover-backdoor-in-solanas.html"},{"credibility":2,"name":"Wiz Threats: Solana web3.js supply chain attack","type":"research","url":"https://threats.wiz.io/all-incidents/solana-web3js-supply-chain-attack"}],"summary":"In early December 2024, two malicious versions (1.95.6 and 1.95.7) of the widely used @solana/web3.js npm library were published after an account with publish rights was reportedly phished. The injected backdoor sent private keys to an attacker-controlled server; reported losses vary by source, from roughly $130K to over $190K. Affected versions were removed and 1.95.8 was released. This page covers only the incident; see /solana for the related ecosystem page.","timeline":[{"date":"2024-11-22","date_evidence":"The C2 domain, sol-rpc[.]xyz, was registered on November 22, 2024","event":"Alleged attacker command-and-control domain sol-rpc[.]xyz registered via NameSilo.","source":"The Hacker News","source_url":"https://thehackernews.com/2024/12/researchers-uncover-backdoor-in-solanas.html"},{"date":"2024-12-03","date_evidence":"\"December 3, 2024\" / \"3:20pm UTC\"","event":"A @solana npm org member with publish access was phished; malicious versions 1.95.6 and 1.95.7 were published shortly after.","source":"Anza root cause analysis","source_url":"https://www.anza.xyz/blog/web3-js-exploit-root-cause-analysis"},{"date":"2024-12-03","date_evidence":"7:30pm - The publishing account's npm credentials were revoked (Anza timeline, December 3, 2024)","event":"Compromised account credentials revoked; clean version 1.95.8 published at 8:25pm UTC.","source":"Anza root cause analysis","source_url":"https://www.anza.xyz/blog/web3-js-exploit-root-cause-analysis"},{"date":"2024-12-04","date_evidence":"\"December 4, 2024\" / \"~12:22 am UTC\"","event":"Versions 1.95.6 and 1.95.7 removed from the npm registry; GitHub security advisory published later that day.","source":"Anza root cause analysis","source_url":"https://www.anza.xyz/blog/web3-js-exploit-root-cause-analysis"},{"date":"2024-12-05","date_evidence":"Thu 5 Dec 2024 // 23:13 UTC","event":"The Register reports the compromise, quoting Helius estimate of roughly $130K in losses.","source":"The Register","source_url":"https://www.theregister.com/2024/12/05/solana_javascript_sdk_compromised/"}]},"v":1}