@solana/web3.js (npm): compromised publish account pushed key-stealing 1.95.6 and 1.95.7 (CVE-2024-54134)
Severity: high · Patch status: patched · Since 2024-12-03 · CVE-2024-54134
On 2024-12-03 an attacker with access to a publish-capable account for @solana/web3.js released versions 1.95.6 and 1.95.7 to npm containing code that stole private key material, with the Solana maintainers stating the malicious window ran from about 15:20 to 20:25 UTC. Socket's analysis found a function injected into code paths that touch private keys that sent them out, disguised with Cloudflare-style headers, to a domain registered on 22 November; the vendor did not say how the account was compromised (Socket suspects phishing or social engineering). Apps, bots and servers that load keys directly and installed or updated in the window were exposed; version 1.95.8 removes the code and the bad versions were pulled. Users with suspected exposure should rotate authority keys such as multisigs, program authorities and server keypairs.
What to do
- Check lockfiles, CI caches and deployed bundles for @solana/web3.js 1.95.6 or 1.95.7 and upgrade to 1.95.8 or later, including projects tracking latest
- If either version ran with key material, rotate the affected keys: multisig and program upgrade authorities, server and bot keypairs, and move funds
- Block and search egress logs for sol-rpc[.]xyz
- Pin exact versions and add a release-age delay so new publishes are not installed automatically
Fixed versions
Sources
All live incidents on Threat Watch
