A malicious package campaign is targeting Solana developers through typosquatted npm and PyPI libraries as stable-build fixes. The malware abuses package lifecycle execution and import-time hooks to steal wallet secrets, cloud credentials, and SSH keys from infected environments. Some samples also expand beyond theft by acting as full backdoors through Telegram-based command-and-control or by deploying Windows-focused loaders built around Deno.
JFrog Security researchers uncovered two separate but related operations. The first, tracked as Solana FakeFix, used counterfeit SDK-style packages to collect sensitive secrets from developers and build systems. The second used CMS-themed npm packages to load Windows executables. Their analysis showed that the malicious code was often appended to otherwise functional-looking libraries, helping the packages appear legitimate while quietly retrieving second-stage payloads dynamically through Deno.
Organizations should remove all affected packages from developer workstations, CI/CD pipelines, and internal package caches. Any potentially exposed credentials should be rotated immediately, including Solana wallet keys, SSH keys, AWS credentials, and GitHub tokens. Security teams should also audit hosts for persistence methods such as Registry Run keys, scheduled tasks, and shell profile modifications.
Defenders should uninstall the identified malicious packages and review dependency lock files for unauthorized or unexpected libraries. All exposed secrets should be rotated at once, and any cryptocurrency stored in potentially compromised wallets should be transferred to new trusted addresses. CI runners and developer systems should then be rebuilt from clean images to ensure no hidden backdoors or persistence mechanisms remain.
Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.
Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.
Attack Narrative & Commands: The attacker has gained initial access and intends to maintain a foothold. They decide to use a Deno-based payload. To hide the execution of the terminal, they use the --headless flag for conhost.exe . They execute a command that modifies the HKCUSoftwareMicrosoftWindowsCurrentVersionRun registry key, adding a value named DenoUpdater that executes conhost.exe --headless deno.exe [malicious_script] . This will ensure the payload runs silently in the background upon user login.
Regression Test Script:
Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
