Supply Chain Attack Detected in Solana's web3.js Library

A supply chain attack injected malicious code into versions 1.95.6 and 1.95.7 of Solana's @solana/web3.js library on npm, designed to steal private keys. Anza, a Solana-focused research and development firm, disclosed on December 3 that a publish-access account had been compromised, and the article states the cause is believed to be social engineering or phishing targeting the library's maintainers. Datadog researcher Christophe Tafani-Dereeper found an "addToQueue" function in v1.95.7 that exfiltrates keys using CloudFlare headers. Helius Labs CEO Mert Mumtaz estimated damage at roughly $130K, while Decrypt projected $160K in stolen assets, and version 1.95.8 was released to remove the injected code.