Solana Library Supply Chain Attack Exposes Cryptocurrency Wallets

A supply-chain compromise of the @solana/web3.js npm library (versions 1.95.6 and 1.95.7), briefly published on 2 December 2024, contained an "addToQueue" backdoor that exfiltrated private keys to sol-rpc.xyz; attackers stole an estimated $130,000–$160,000 in SOL. Developers are advised to audit dependencies, update to 1.95.8, and rotate keys and program authorities if compromise is suspected.