Five typosquatted npm packages hook Base58 decoding to steal Solana and Ethereum private keys
npm packages raydium-bs58, base-x-64, bs58-basic, ethersproject-wallet, base_xd
In March 2026, Cyber Press reported five malicious npm packages from the account 'galedonovan', aimed at crypto developers: raydium-bs58, base-x-64, bs58-basic, ethersproject-wallet and base_xd. The Solana packages intercept Base58 decode() calls used to load keypairs and send the private key in plain text to a Telegram bot, while the app keeps working normally. The Ethereum package hooks the Wallet constructor. base_xd was pulled within five minutes, but the other four were still live when the report came out. Developers who installed any of them should rotate keys and move funds.
Why this severity: Only partly contained, a narrower target.
- Started
- Mar 26, 2026
- Closed
- Mar 26, 2026
- Method
- Supply-chain stealers
At risk
- npm packages raydium-bs58, base-x-64, bs58-basic, ethersproject-wallet, base_xd
- Solana wallets
- Ethereum wallets
What to do now
- Treat every private key the code decoded or loaded as stolen. Move funds to new keys created on a clean machine.
- Remove the packages, reinstall from a clean lockfile, and rotate any CI or deploy secrets.
- Block outbound Telegram API traffic from build servers that don't need it.
Stay safe
Am I affected?
Search your package.json and lockfiles (package-lock.json, yarn.lock, pnpm-lock.yaml) for raydium-bs58, base-x-64, bs58-basic, ethersproject-wallet or base_xd. bs58-basic pulls in base-x-64 behind the scenes, so check transitive dependencies too. Theft needs Node.js 18 or newer, but assume exposure if any of these ran on your machine or CI.
What to do now
- Treat every private key the code decoded or loaded as stolen. Move funds to new keys created on a clean machine.
- Remove the packages, reinstall from a clean lockfile, and rotate any CI or deploy secrets.
- Block outbound Telegram API traffic from build servers that don't need it.
How to avoid this
- Install the real libraries (bs58, @ethersproject/wallet) and check exact names before adding dependencies.
- Use a package-scanning tool in CI and pin exact versions with lockfiles.
- Keep funded private keys out of dev and CI environments; use test keys there.
Timeline 1
Cyber Press reported five 'galedonovan' npm packages that exfiltrate Solana and Ethereum private keys to a Telegram bot; four were still live.
Source
News & write-ups ›1
How this method works
A popular code package or app update is hijacked to steal wallet keys or swap addresses, hitting everyone who installs it. Read about supply-chain stealers →
Follow new drains and updates in your feed reader or Telegram RSS bot.