The malicious npm packages, including a typosquat of the popular async-mutex package, were still available for download at the time of the report. Researchers warned about Google AI-powered summaries that could mislead developers into installing harmful dependencies. The attack code can handle multiple private keys simultaneously, compromising multiple user accounts or environments. The researchers have reported the malicious packages and associated GitHub repositories to relevant authorities for removal.
Key takeaways:
- Researchers have identified a threat campaign targeting Solana crypto wallets by stealing private keys through Gmail.
- Two threat actors are using Gmail to exfiltrate Solana private keys, exploiting its trusted status to bypass security measures.
- Malicious npm packages, disguised as legitimate tools, are being used to intercept and exfiltrate private keys via Gmail's SMTP servers.
- The attack code can handle multiple private keys simultaneously, compromising multiple user accounts or environments at once.