恶意 NPM 包窃私钥，Solana 用户资产遭盗

深潮Published on 2025-07-04Last updated on 2025-07-04

恶意开源项目植入后门NPM包，窃取用户私钥致Solana钱包资产被盗。

作者：Thinking

编辑：Liz

背景概述

2025 年 7 月 2 日，一名受害者联系到慢雾安全团队，寻求协助分析其钱包资产被盗的原因。事件起因于他前一天使用了一个托管在 GitHub 上的开源项目 —— zldp2002/solana-pumpfun-bot，随后加密资产被盗。

分析过程

我们随即着手调查此次事件。首先访问该项目的 GitHub 仓库：https://github.com/zldp2002/solana-pumpfun-bot，可以看到它的 Star 和 Fork 数量相对较高，但其各个目录下的代码提交时间均集中在三周前，呈现出明显的异常，缺乏正常项目应有的持续更新轨迹。

恶意NPM包窃私钥，Solana用户资产遭盗

这是一个基于 Node.js 的项目。我们首先对其依赖包进行了分析，发现其引用了一个名为 crypto-layout-utils 的第三方包。

恶意NPM包窃私钥，Solana用户资产遭盗

进一步核查发现，该依赖包已被 NPM 官方下架，而且 package.json 中指定的版本并未出现在 NPM 官方的历史记录中。我们初步判断该包为可疑组件，并已无法通过 NPM 官方源进行下载。那么，受害者又是如何获取到这个恶意依赖的呢？

恶意NPM包窃私钥，Solana用户资产遭盗

继续深入项目，我们在 package-lock.json 文件中找到了关键线索：攻击者将 crypto-layout-utils 的下载链接替换成了：https://github.com/sjaduwhv/testing-dev-log/releases/download/1.3.1/crypto-layout-utils-1.3.1.tgz。

恶意NPM包窃私钥，Solana用户资产遭盗

我们下载了这个可疑的依赖包：crypto-layout-utils-1.3.1，发现这是一个使用 jsjiami.com.v7 进行高度混淆后的代码，这增加了分析的难度。

恶意NPM包窃私钥，Solana用户资产遭盗

恶意NPM包窃私钥，Solana用户资产遭盗

解混淆后我们确认了这是一个恶意的 NPM 包，攻击者在 crypto-layout-utils-1.3.1 中实现了扫描受害者电脑文件的逻辑，如果发现钱包或私钥相关的内容或文件就上传到攻击者控制的服务器上(githubshadow.xyz)。

恶意 NPM 包扫描敏感文件和目录：

恶意NPM包窃私钥，Solana用户资产遭盗

恶意 NPM 包上传包含私钥的内容或文件：

恶意NPM包窃私钥，Solana用户资产遭盗

我们继续探索攻击手法，项目作者(https://github.com/zldp2002/) 疑似控制了一批 GitHub 账号， 用于 Fork 恶意项目并进行恶意程序分发，同时刷高项目的 Fork 和 Star 数量，引诱更多用户关注，以便扩大恶意程序的分发范围。

恶意NPM包窃私钥，Solana用户资产遭盗

我们还识别出多个 Fork 项目也存在类似恶意行为，其中部分版本使用了另一款恶意包 bs58-encrypt-utils-1.0.3。

该恶意包自 2025 年 6 月 12 日创建，猜测攻击者这时候就已经开始分发恶意 NPM 和恶意 Node.js 项目，但在 NPM 下架 bs58-encrypt-utils 后，攻击者改用了替换 NPM 包下载链接的方式进行分发。

恶意NPM包窃私钥，Solana用户资产遭盗

此外，我们使用链上反洗钱与追踪工具 MistTrack 分析发现，其中一个攻击者地址盗币后，将资金转移至了交易平台 FixedFloat。

恶意NPM包窃私钥，Solana用户资产遭盗

总结

本次攻击事件中，攻击者通过伪装为合法开源项目(solana-pumpfun-bot)，诱导用户下载并运行恶意代码。在刷高项目热度的掩护下，用户在毫无防备的情况下运行了携带恶意依赖的 Node.js 项目，导致钱包私钥泄露、资产被盗。

整个攻击链条涉及多个 GitHub 账号协同操作，扩大了传播范围，提升了可信度，极具欺骗性。同时，这类攻击通过社会工程与技术手段双管齐下，在组织内部也很难完全防御。

我们建议开发者与用户高度警惕来路不明的 GitHub 项目，尤其是在涉及钱包或私钥操作时。如果确实需要运行调试，建议在独立且没有敏感数据的机器环境运行和调试。

 

恶意依赖包相关信息

恶意 Node.js 项目的 GitHub 仓库：

2723799947qq2022/solana-pumpfun-bot

2kwkkk/solana-pumpfun-bot

790659193qqch/solana-pumpfun-bot

7arlystar/solana-pumpfun-bot

918715c83/solana-pumpfun-bot

AmirhBeigi7zch6f/solana-pumpfun-bot

asmaamohamed0264/solana-pumpfun-bot

bog-us/solana-pumpfun-bot

edparker89/solana-pumpfun-bot

ii4272/solana-pumpfun-bot

ijtye/solana-pumpfun-bot

iwanjunaids/solana-pumpfun-bot

janmalece/solana-pumpfun-bot

kay2x4/solana-pumpfun-bot

lan666as2dfur/solana-pumpfun-bot

loveccat/solana-pumpfun-bot

lukgria/solana-pumpfun-bot

mdemetrial26rvk9w/solana-pumpfun-bot

oumengwas/solana-pumpfun-bot

pangxingwaxg/solana-pumpfun-bot

Rain-Rave5/solana-pumpfun-bot

wc64561673347375/solana-pumpfun-bot

wj6942/solana-pumpfun-bot

xnaotutu77765/solana-pumpfun-bot

yvagSirKt/solana-pumpfun-bot

VictorVelea/solana-copy-bot

Morning-Star213/Solana-pumpfun-bot

warp-zara/solana-trading-bot

harshith-eth/quant-bot

恶意 NPM 包：

crypto-layout-utils

bs58-encrypt-utils

恶意 NPM 包下载链接：

https://github.com/sjaduwhv/testing-dev-log/releases/download/1.3.1/crypto-layout-utils-1.3.1.tgz

恶意 NPM 包上传数据的服务器：

githubshadow.xyz

Trending Cryptos

ctr
CitreaCTR
wstusdt
wrapped stUSDTWSTUSDT
apr
aPrioriAPR
ctx
Cryptex FinanceCTX
audio
AudiusAUDIO
mantra
MantraMANTRA
xvs
VenusXVS
waxl
AxelarWAXL
bill
Billions NetworkBILL
pyth
PYTH (Pyth)PYTH
rune
THORChainRUNE
brev
BrevisBREV
zrx
ZRX（0X）ZRX
cake
PancakeSwapCAKE
jst
JUSTJST

Related Reads

Catholic And Law Enforcement Groups Warn CLARITY Act Could Weaken Crypto Crime Safeguards

A coalition of Catholic leaders, law enforcement groups, and anti-trafficking advocates warns that the CLARITY Act could weaken safeguards against crypto-enabled crime. Their criticism focuses on provisions that would protect developers of non-custodial software (like wallets and DeFi protocols) from being regulated as money transmitters. This highlights a core regulatory dilemma: distinguishing neutral software from financial intermediation. Crypto advocates argue such developers should not be treated like exchanges, while critics fear broad exemptions could hinder the tracking of illicit finance, including human trafficking and sanctions evasion. The bill aims to create clearer market-structure rules, but this opposition shows the debate extends beyond investor protection to law enforcement concerns. The pushback means supporters may need to address these issues, potentially leading to amendments or stricter requirements. For the crypto industry, clearer rules could spur U.S. investment, but the bill faces a tougher political path if framed as weakening crime-fighting tools.

bitcoinist2h ago

Catholic And Law Enforcement Groups Warn CLARITY Act Could Weaken Crypto Crime Safeguards

bitcoinist2h ago

The Full Story of How Crypto Unicorn Blockstream Is Mired in Serious Fraud Allegations

This article details serious allegations of fraud against Bitcoin infrastructure company Blockstream, founded by Bitcoin pioneer Adam Back. In June 2024, investigative account NatInfoSec published a report accusing Blockstream's mining note (BMN) program of potentially operating a multi-billion dollar scheme with Ponzi-like characteristics. The core allegations focus on Blockstream Mining Notes (BMNs), which offer investors fixed annual yields up to approximately 20% from Bitcoin mining. NatInfoSec's investigation raises several key issues: 1. **Suspicious Hashrate & Payout Capacity**: The analysis suggests Blockstream would need 20-45 EH/s of mining power to cover its BMN obligations, but its public dashboard shows only around 15 EH/s. Furthermore, no verifiable public evidence (e.g., grid connection records, import data) was found to support the massive mining operation required. 2. **Questionable Payout Source**: The BMN contract allows Blockstream to use Bitcoin from *any source* (Substitute Performance BTC) to fulfill investor payouts, raising concerns that payouts may not come from actual mining revenue. 3. **High-Risk, Fixed Returns**: Offering ~20% fixed yields in the volatile, cyclical Bitcoin mining industry is viewed as highly unusual and requires clear explanation. 4. **Undisclosed Criminal Record of Key Figure**: Christopher William Cook, a key figure in Blockstream's mining operations and CEO of spin-off Exacore, was found to have a federal felony conviction for mail fraud in 2008, a fact not disclosed in BMN offering documents. His background was also allegedly embellished. 5. **Potential Contagion to BSTR SPAC**: Questions were raised about whether these liabilities and Cook's record should have been disclosed in the SEC filings for Bitcoin Standard Treasury Company (BSTR), a separate Adam Back-associated firm planning a SPAC merger. The crypto community is divided. BitMEX Research validated Cook's criminal record and expressed concern over the high yields but found other evidence lacking or misleading, noting the legal separation between BMN, Blockstream, and BSTR. Blockstream defenders, like Samson Mow, argue the mining is real. Critics, however, emphasize the lack of independent, verifiable proof of the mining operation's scale and the true source of investor payouts. The article concludes that BMN remains shrouded in key unanswered questions regarding its actual size, the verifiability of its underlying mining assets and payouts, the source of its high yields, and the full role and disclosure concerning Chris Cook. Blockstream had not issued a comprehensive response at the time of writing.

marsbit6h ago

The Full Story of How Crypto Unicorn Blockstream Is Mired in Serious Fraud Allegations

marsbit6h ago

South Korea Targets 40 Unregistered Crypto Operators in Regulatory Crackdown

South Korea's Financial Intelligence Unit has referred around 40 unregistered virtual asset service providers to the police as part of a regulatory crackdown. Under local law, all crypto exchanges must obtain ISMS certification and FIU registration before operating, yet only 28 entities are currently registered. The FIU identified methods used by offshore platforms to attract Korean users, including advertising on local messaging apps and using private money changers to convert stablecoins. Officials stressed that unregistered platforms are not protected by Korean law. This action aligns with South Korea's push for stricter global crypto compliance through FATF measures. FIU Director Lee Hyung-joo recently urged FATF members to remove transaction thresholds for the "Travel Rule," as South Korea plans to mandate identity checks for all crypto transactions starting in August, expanding from the current 1 million won (≈$730) minimum. Regulatory enforcement has intensified in 2026, with authorities pursuing criminal cases against market manipulation schemes and enhancing cooperation with financial institutions to curb cross-border illegal transactions.

TheNewsCrypto7h ago

South Korea Targets 40 Unregistered Crypto Operators in Regulatory Crackdown

TheNewsCrypto7h ago

Trading

Spot
Futures

Hot Articles

Discussions

Welcome to the HTX Community. Here, you can stay informed about the latest platform developments and gain access to professional market insights. Users' opinions on the price of SOL (SOL) are presented below.

活动图片

Top Questions