Solana web3.js Supply Chain Attack (Campaign)

On December 2–3, 2024 a supply-chain compromise of the @solana/web3.js JavaScript library (versions 1.95.6 and 1.95.7) introduced an obfuscated backdoor that captured and exfiltrated private keys to an attacker-controlled domain (sol-rpc.xyz), resulting in over $190,000 stolen; the malicious code was deployed via a compromised npm account, active for approximately five hours, and mitigated by revoking the malicious packages, taking down the C2, and releasing a patched version (1.95.8).