Verify a decision

{"actor":"system:backfill","investigation_id":"82e6ee16-7dc7-4c24-a16e-076ca4a27235","kind":"publish","page_slug":"galedonovan-npm-crypto-stealer-campaign-2026","published_at":"2026-10-29T20:23:27.758Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Galedonovan npm Crypto-Stealer Campaign (2026)","sections":[{"content":"Security-news outlets reported in 2026 that five npm packages — raydium-bs58, base-x-64, bs58-basic, base_xd, and ethersproject-wallet — were designed to steal cryptocurrency private keys from developers who installed them. According to these reports, four of the packages targeted Solana developers by hooking Base58 decode() calls commonly used to load Solana keypairs from secret-key strings, while the fifth, ethersproject-wallet, was a trojanized copy of the legitimate @ethersproject/wallet library that triggered when a private key was passed into its Wallet constructor. Reports state the packages were published from a single npm account, with press coverage naming the account \"galedonovan,\" though this account name could not be independently verified: the npm registry entries for the affected packages now show no maintainer information, the account's package listing returns no results, and no primary npm or GitHub profile under that name could be located.","heading":"Campaign overview","severity":"high","sources":[{"credibility":2,"name":"Cyber Security News — \"Five Malicious npm Packages Target Crypto Developers, Steal Wallet Keys via Telegram\"","type":"news_article","url":"https://cybersecuritynews.com/five-malicious-npm-packages/amp/"},{"credibility":2,"name":"GBHackers — mirrored coverage of the same campaign","type":"news_article","url":"https://gbhackers.com/five-malicious-npm-packages/amp/"},{"credibility":2,"name":"Cyberpress — \"Telegram-Driven Attack Targets Crypto Developers with Malicious npm Packages\"","type":"news_article","url":"https://cyberpress.org/telegram-attack-targets-crypto-developers/"}]},{"content":"The open-source malicious-packages advisory database (OSV/GHSA, which aggregates npm malware findings credited to Amazon Inspector) confirms that base-x-64, bs58-basic, raydium-bs58, and ethersproject-wallet each contained embedded malicious code (CWE-506). Separately, OffSeq's threat radar and OSV entries for closely related — but not identical — packages named \"ethers-wallet-package\" and \"ethers-wallet-packages\" describe the specific mechanism reported for this family of attacks: the package impersonates a legitimate library, wraps the Wallet constructor in obfuscated code, and sends the constructor's first argument (which can be a raw private key, an account object, or a mnemonic) to a hardcoded Telegram bot endpoint as soon as a wallet is instantiated. Press coverage of the raydium-bs58/base-x-64/bs58-basic/base_xd/ethersproject-wallet set describes the same pattern for the Solana-targeting packages: a modified Base58 decode() function exfiltrates the input before returning the expected decoded value, so the exploit is largely invisible to a developer watching for functional correctness. One report noted the malware depends on the global fetch API, limiting it to Node.js 18 and later, and that bs58-basic itself contained no malicious code directly but pulled in base-x-64, which did.","heading":"Technical mechanism: Base58 decode and ethers.js Wallet hooks","severity":"critical","sources":[{"credibility":1,"name":"OSV — MAL-2026-2323, Malicious code in ethersproject-wallet (npm)","type":"official","url":"https://osv.dev/vulnerability/MAL-2026-2323"},{"credibility":1,"name":"OSV — MAL-2026-2326, Malicious code in raydium-bs58 (npm)","type":"official","url":"https://osv.dev/vulnerability/MAL-2026-2326"},{"credibility":1,"name":"OSV — MAL-2026-2322, Malicious code in bs58-basic (npm)","type":"official","url":"https://osv.dev/vulnerability/MAL-2026-2322"},{"credibility":1,"name":"OSV — MAL-2026-2320, Malicious code in base-x-64 (npm)","type":"official","url":"https://osv.dev/vulnerability/MAL-2026-2320"},{"credibility":2,"name":"OffSeq Threat Radar — Malicious code in ethers-wallet-packages (npm), a related impersonation of the same wallet library","type":"research","url":"https://radar.offseq.com/threat/malicious-code-in-ethers-wallet-packages-npm-f35f337ca55a8da7"},{"credibility":2,"name":"Cyber Security News — Five Malicious npm Packages","type":"news_article","url":"https://cybersecuritynews.com/five-malicious-npm-packages/amp/"}]},{"content":"Multiple reports describe the stolen keys as being sent to a hardcoded Telegram bot shared across the five packages, consistent with the Telegram-bot exfiltration mechanism documented in OSV/GHSA advisories for closely related ethers.js-impersonating packages. One outlet reported that the raydium-bs58 package accidentally exposed the attacker's bot token and a group invite link in a source-code comment, and separately named a specific bot handle and Telegram group/user identifiers allegedly tied to the operation. These specific identifiers (the bot handle and group account) appear in only a single aggregator source and could not be corroborated elsewhere, so they are treated here as low-confidence, unverified allegations.","heading":"Telegram command-and-control infrastructure","severity":"high","sources":[{"credibility":2,"name":"Cyber Security News — Five Malicious npm Packages (bot token exposure, alleged bot/group identifiers)","type":"news_article","url":"https://cybersecuritynews.com/five-malicious-npm-packages/amp/"},{"credibility":1,"name":"OSV — MAL-2026-4554, Malicious code in ethers-wallet-packages (npm), describing the same Telegram-bot exfiltration pattern in a related package","type":"official","url":"https://osv.dev/vulnerability/MAL-2026-4554"}]},{"content":"Direct queries to the public npm registry (registry.npmjs.org) show that the four packages that remained on npm (base-x-64, bs58-basic, raydium-bs58, ethersproject-wallet) were originally published well before the 'March 2026' window cited in some secondary reporting: raydium-bs58 version 1.9.7 was published 2025-11-18, base-x-64 version 0.0.5 and bs58-basic version 6.0.0 were both published 2025-11-28, and ethersproject-wallet version 5.8.0 was published 2026-02-16. All four packages' registry records now contain only a placeholder version '0.0.1-security' with no maintainers, timestamped 2026-04-01 — the format npm uses when it strips a package's code and account access following a malware takedown. This closely matches the publish timestamps (2026-04-01T09:11:0x UTC) of the corresponding OSV/GHSA malware advisories, indicating the actual registry-side removal occurred on April 1, 2026, not earlier in March as some press coverage suggested when it stated several packages 'remained live... at the time of analysis.' The fifth package, base_xd, has a registry history showing it was published and unpublished on the same day, 2025-11-28, substantially earlier than the 'published and removed within minutes' framing tied to the broader March 2026 news cycle in secondary coverage.","heading":"npm registry timeline and takedown status","severity":"medium","sources":[{"credibility":1,"name":"npm registry metadata for raydium-bs58, base-x-64, bs58-basic, ethersproject-wallet, and base_xd (direct registry query)","type":"official","url":"https://registry.npmjs.org/raydium-bs58"},{"credibility":1,"name":"OSV — MAL-2026-2323 (ethersproject-wallet), confirming 2026-04-01 advisory publication","type":"official","url":"https://osv.dev/vulnerability/MAL-2026-2323"},{"credibility":2,"name":"Cyber Security News — reporting packages 'remained available in the registry at the time of analysis'","type":"news_article","url":"https://cybersecuritynews.com/five-malicious-npm-packages/amp/"}]},{"content":"Secondary press coverage attributes discovery of this campaign to the supply-chain security firm Socket, and names the responsible npm publisher account as 'galedonovan.' Neither claim could be independently verified from primary sources available at the time of this investigation: the official OSV/GHSA malicious-packages advisories for all four packages confirmed live on npm (base-x-64, bs58-basic, raydium-bs58, ethersproject-wallet) credit 'Amazon Inspector' as the finder, not Socket, and no npm or GitHub account named 'galedonovan' could be located — consistent with npm's practice of stripping account and maintainer data from packages removed for malware. It is possible both Socket and Amazon Inspector independently flagged the same packages, which would not be contradictory, but this investigation could not confirm that detail either way. Readers should treat the specific attribution to a named individual or account as an unverified allegation pending a primary Socket publication.","heading":"Attribution uncertainty","severity":"low","sources":[{"credibility":1,"name":"OSV — MAL-2026-2323, credited finder Amazon Inspector","type":"official","url":"https://osv.dev/vulnerability/MAL-2026-2323"},{"credibility":2,"name":"Cyber Security News — attributing discovery and account name to Socket research","type":"news_article","url":"https://cybersecuritynews.com/five-malicious-npm-packages/amp/"}]},{"content":"Searches conducted for this investigation surfaced a larger, ongoing wave of npm typosquatting packages that impersonate base-x, bs58, and ethers.js-style wallet libraries, including base65-85x, base65-77x, base65-33x, base65-12x, bs58-86, bs58-11, bs58-88, ethers-wallet-package, and ethers-wallet-packages, logged in OSV between April and September 2026. These share the same general exfiltration pattern (hooking a decode or wallet constructor and posting secrets to an attacker-controlled endpoint) but are distinct packages, published at different times, and are not confirmed to be the work of the same account or campaign described in this entry. They should not be conflated with the galedonovan-attributed five-package campaign that is the subject of this page, and are noted here only to avoid future duplicate or merged reporting.","heading":"Related typosquatting families (not part of this campaign)","severity":"low","sources":[{"credibility":1,"name":"OSV — MAL-2026-4554, Malicious code in ethers-wallet-packages (npm)","type":"official","url":"https://osv.dev/vulnerability/MAL-2026-4554"},{"credibility":1,"name":"OSV — MAL-2026-4553, Malicious code in ethers-wallet-package (npm)","type":"official","url":"https://osv.dev/vulnerability/MAL-2026-4553"}]}],"sources_used":[{"credibility":2,"name":"Cyber Security News — Five Malicious npm Packages Target Crypto Developers, Steal Wallet Keys via Telegram","type":"news_article","url":"https://cybersecuritynews.com/five-malicious-npm-packages/amp/"},{"credibility":2,"name":"GBHackers — mirrored coverage of the same campaign","type":"news_article","url":"https://gbhackers.com/five-malicious-npm-packages/amp/"},{"credibility":2,"name":"Cyberpress — Telegram-Driven Attack Targets Crypto Developers with Malicious npm Packages","type":"news_article","url":"https://cyberpress.org/telegram-attack-targets-crypto-developers/"},{"credibility":1,"name":"OSV — MAL-2026-2323, Malicious code in ethersproject-wallet (npm)","type":"official","url":"https://osv.dev/vulnerability/MAL-2026-2323"},{"credibility":1,"name":"OSV — MAL-2026-2326, Malicious code in raydium-bs58 (npm)","type":"official","url":"https://osv.dev/vulnerability/MAL-2026-2326"},{"credibility":1,"name":"OSV — MAL-2026-2322, Malicious code in bs58-basic (npm)","type":"official","url":"https://osv.dev/vulnerability/MAL-2026-2322"},{"credibility":1,"name":"OSV — MAL-2026-2320, Malicious code in base-x-64 (npm)","type":"official","url":"https://osv.dev/vulnerability/MAL-2026-2320"},{"credibility":1,"name":"OSV — MAL-2026-4554, Malicious code in ethers-wallet-packages (npm)","type":"official","url":"https://osv.dev/vulnerability/MAL-2026-4554"},{"credibility":1,"name":"OSV — MAL-2026-4553, Malicious code in ethers-wallet-package (npm)","type":"official","url":"https://osv.dev/vulnerability/MAL-2026-4553"},{"credibility":2,"name":"OffSeq Threat Radar — Malicious code in ethers-wallet-packages (npm)","type":"research","url":"https://radar.offseq.com/threat/malicious-code-in-ethers-wallet-packages-npm-f35f337ca55a8da7"},{"credibility":1,"name":"npm registry metadata — raydium-bs58","type":"official","url":"https://registry.npmjs.org/raydium-bs58"},{"credibility":1,"name":"npm registry metadata — base-x-64","type":"official","url":"https://registry.npmjs.org/base-x-64"},{"credibility":1,"name":"npm registry metadata — bs58-basic","type":"official","url":"https://registry.npmjs.org/bs58-basic"},{"credibility":1,"name":"npm registry metadata — ethersproject-wallet","type":"official","url":"https://registry.npmjs.org/ethersproject-wallet"},{"credibility":1,"name":"npm registry metadata — base_xd","type":"official","url":"https://registry.npmjs.org/base_xd"}],"summary":"Security researchers reported that five npm packages — raydium-bs58, base-x-64, bs58-basic, base_xd, and ethersproject-wallet — were published under an npm account described in press reports as \"galedonovan\" and used to intercept Solana and Ethereum private keys, sending them to a Telegram bot. npm registry records independently confirm all five packages existed and were malicious, though the registry's own timestamps show the packages were first published between November 2025 and February 2026 and were pulled from the registry on April 1, 2026 — a different timeline than the \"March 2026\" framing used by some secondary reports. The npm account name, the specific Telegram bot handle, and attribution of discovery to Socket (rather than Amazon Inspector, credited in the official malware advisories) could not be independently confirmed from primary sources.","timeline":[{"date":"2025-11","date_evidence":"npm registry version-publish timestamp for raydium-bs58 1.9.7: \"1.9.7\": \"2025-11-18T06:40:49.807Z\"","date_original":"2025-11-18","event":"raydium-bs58 version 1.9.7 first published to the npm registry.","source":"npm registry (registry.npmjs.org)","source_url":"https://registry.npmjs.org/raydium-bs58"},{"date":"2025-11","date_evidence":"npm registry timestamps: bs58-basic \"6.0.0\": \"2025-11-28T19:20:03.301Z\"; base-x-64 \"0.0.5\": \"2025-11-28T19:14:15.076Z\"; base_xd \"0.0.5\": \"2025-11-28T19:03:24.274Z\" with \"unpublished\":{\"time\":\"2025-11-28T19:08:30.688Z\"}","date_original":"2025-11-28","event":"bs58-basic and base-x-64 first published; base_xd published and unpublished the same day.","source":"npm registry (registry.npmjs.org)","source_url":"https://registry.npmjs.org/bs58-basic"},{"date":"2026-02","date_evidence":"npm registry version-publish timestamp: ethersproject-wallet \"5.8.0\": \"2026-02-16T15:23:44.788Z\"","date_original":"2026-02-16","event":"ethersproject-wallet version 5.8.0, a trojanized copy of @ethersproject/wallet, first published to npm.","source":"npm registry (registry.npmjs.org)","source_url":"https://registry.npmjs.org/ethersproject-wallet"},{"date":"2026-03","event":"Secondary security-news outlets report a Socket-attributed campaign of five malicious npm packages from an account described as 'galedonovan' targeting Solana and Ethereum developers via a Telegram bot C2.","source":"Cyber Security News / Cyberpress / GBHackers","source_url":"https://cybersecuritynews.com/five-malicious-npm-packages/amp/"},{"date":"2026-04-01","date_evidence":"npm registry security-placeholder timestamps, e.g. ethersproject-wallet \"0.0.1-security\": \"2026-04-01T09:10:24.584Z\"; corresponding OSV advisory MAL-2026-2323 \"Published: 2026-04-01T09:11:09Z\"","event":"npm registry removes the code from base-x-64, bs58-basic, raydium-bs58, and ethersproject-wallet, replacing all versions with a '0.0.1-security' placeholder; GitHub/OSV malware advisories for all four packages are published the same day, crediting Amazon Inspector as finder.","source":"npm registry / OSV","source_url":"https://osv.dev/vulnerability/MAL-2026-2323"}]},"v":1}