Solana FakeFix Campaign Uses 25 Malicious npm and PyPI Packages to Steal Developer Secrets

Cybersecuritynews •Tushar Subhra Dutta • June 12, 2026

A newly discovered supply chain campaign is putting Solana developers at serious risk, with attackers hiding malicious code inside fake developer packages on npm and PyPI. The operation, tracked as “Solana FakeFix,” deployed 25 malicious packages designed to steal wallet keys, cloud credentials, SSH keys, and developer secrets the moment a package is installed or […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Solana FakeFix Campaign Targets Developers with Malicious Packages A malicious campaign named Solana FakeFix is targeting Solana developers by deploying 25 typosquatted npm and PyPI packages. These packages are designed to steal sensitive information such as wallet keys, cloud credentials, and SSH keys upon installation. The malware exploits package lifecycle execution and import-time hooks, allowing it to operate undetected. Some variants also function as backdoors, utilizing Telegram for command-and-control operations. JFrog Security researchers have identified the operation and recommend immediate removal of the affected packages from development environments. Organizations are advised to rotate any exposed credentials and audit systems for persistence methods. The campaign poses a significant risk to developers and their projects, emphasizing the need for heightened security measures. 2 sources 71

Extracted Entities

Solana FakeFix Campaign Uses 25 Malicious npm and PyPI Packages to Steal Developer Secrets

The full story

Extracted Entities

Attack Types (1)

Campaigns (1)

MITRE ATT&CK (2)

Platforms (1)

Tools (1)