Malware found in Solana npm library raises the bar for crypto security

Unknown attackers compromised the widely used @solana/web3.js npm package (v1.95.6 and v1.95.7), inserting a backdoor (including an "addToQueue" function) that exfiltrates private keys to https://sol-rpc.xyz; GitHub and researchers recommend downgrading to 1.95.5 or upgrading to 1.95.8 and rotating all secrets, and evidence suggests a maintainer publish-account compromise broadened the potential blast radius across thousands of dependent projects and many users.