WARNING: A supply chain attack was detected in versions 1.95.6 and 1.95.7 of the @solana/web3.js library, which affects many developers. The malicious code aims to exfiltrate private keys and compromise wallets.

Please be cautioned to refrain from interacting with dApps in the Solana Ecosystem for the immediate time period as the situation gets resolved.

Believed to be the result of a social engineering/phishing attack targeting maintainers of the official Web3.js open source library maintained by Solana and receives more than 350,000 weekly downloads on NPM.

Developers integrating these versions into their projects risk exposing their private keys. Phantom Wallet has confirmed it is not impacted by these vulnerabilities, however, users of applications relying on the compromised libraries risk having their wallets drained.

This is a developing story, further updates can be found on Socket or by using Exponent Analyst AI to aggregate and monitor related news (link in the comments). Show Less