{
 "slug": "npm-galedonovan-solana-key-stealers-mar-2026",
 "title": "Five typosquatted npm packages hook Base58 decoding to steal Solana and Ethereum private keys",
 "url": "https://drains.watch/i/npm-galedonovan-solana-key-stealers-mar-2026",
 "json": "https://drains.watch/i/npm-galedonovan-solana-key-stealers-mar-2026.json",
 "status": "closed",
 "severity": "medium",
 "threatStatus": "partly-contained",
 "verification": "verified",
 "chains": [
  "solana",
  "ethereum"
 ],
 "method": "supply-chain",
 "product": "npm packages raydium-bs58, base-x-64, bs58-basic, ethersproject-wallet, base_xd",
 "tags": [
  "solana",
  "ethereum",
  "supply-chain",
  "npm",
  "typosquat",
  "bs58",
  "base58",
  "telegram-c2",
  "developers",
  "raydium"
 ],
 "amountUsd": null,
 "victims": null,
 "startedAt": "2026-03-26",
 "closedAt": "2026-03-26",
 "updatedAt": "2026-03-26T12:00:00Z",
 "summary": "In March 2026, Cyber Press reported five malicious npm packages from the account 'galedonovan', aimed at crypto developers: raydium-bs58, base-x-64, bs58-basic, ethersproject-wallet and base_xd. The Solana packages intercept Base58 decode() calls used to load keypairs and send the private key in plain text to a Telegram bot, while the app keeps working normally. The Ethereum package hooks the Wallet constructor. base_xd was pulled within five minutes, but the other four were still live when the report came out. Developers who installed any of them should rotate keys and move funds.",
 "timeline": [
  {
   "date": "2026-03-26",
   "title": "Cyber Press reported five 'galedonovan' npm packages that exfiltrate Solana and Ethereum private keys to a Telegram bot; four were still live.",
   "sourceUrl": "https://cyberpress.org/telegram-attack-targets-crypto-developers/"
  }
 ],
 "sources": [
  {
   "kind": "news",
   "title": "Telegram-Driven Attack Targets Crypto Developers with Malicious npm Packages",
   "url": "https://cyberpress.org/telegram-attack-targets-crypto-developers/",
   "publisher": "Cyber Press",
   "date": "2026-03-26"
  }
 ],
 "indicators": {
  "domains": [],
  "addresses": []
 },
 "brief": "## Am I affected?\nSearch your package.json and lockfiles (package-lock.json, yarn.lock, pnpm-lock.yaml) for raydium-bs58, base-x-64, bs58-basic, ethersproject-wallet or base_xd. bs58-basic pulls in base-x-64 behind the scenes, so check transitive dependencies too. Theft needs Node.js 18 or newer, but assume exposure if any of these ran on your machine or CI.\n\n## What to do now\n- Treat every private key the code decoded or loaded as stolen. Move funds to new keys created on a clean machine.\n- Remove the packages, reinstall from a clean lockfile, and rotate any CI or deploy secrets.\n- Block outbound Telegram API traffic from build servers that don't need it.\n\n## How to avoid this\n- Install the real libraries (bs58, @ethersproject/wallet) and check exact names before adding dependencies.\n- Use a package-scanning tool in CI and pin exact versions with lockfiles.\n- Keep funded private keys out of dev and CI environments; use test keys there.",
 "notes": null,
 "agentBrief": "# Five typosquatted npm packages hook Base58 decoding to steal Solana and Ethereum private keys\n\n- Severity: Medium · Status: Partly contained (past)\n- Chains: Solana, Ethereum · Method: Supply-chain stealers\n- Started: Mar 26, 2026 · Last update: Mar 26, 2026\n- Who/what: npm packages raydium-bs58, base-x-64, bs58-basic, ethersproject-wallet, base_xd\n\nIn March 2026, Cyber Press reported five malicious npm packages from the account 'galedonovan', aimed at crypto developers: raydium-bs58, base-x-64, bs58-basic, ethersproject-wallet and base_xd. The Solana packages intercept Base58 decode() calls used to load keypairs and send the private key in plain text to a Telegram bot, while the app keeps working normally. The Ethereum package hooks the Wallet constructor. base_xd was pulled within five minutes, but the other four were still live when the report came out. Developers who installed any of them should rotate keys and move funds.\n\n## Am I affected?\nSearch your package.json and lockfiles (package-lock.json, yarn.lock, pnpm-lock.yaml) for raydium-bs58, base-x-64, bs58-basic, ethersproject-wallet or base_xd. bs58-basic pulls in base-x-64 behind the scenes, so check transitive dependencies too. Theft needs Node.js 18 or newer, but assume exposure if any of these ran on your machine or CI.\n\n## What to do now\n- Treat every private key the code decoded or loaded as stolen. Move funds to new keys created on a clean machine.\n- Remove the packages, reinstall from a clean lockfile, and rotate any CI or deploy secrets.\n- Block outbound Telegram API traffic from build servers that don't need it.\n\n## How to avoid this\n- Install the real libraries (bs58, @ethersproject/wallet) and check exact names before adding dependencies.\n- Use a package-scanning tool in CI and pin exact versions with lockfiles.\n- Keep funded private keys out of dev and CI environments; use test keys there.\n\n## Sources\n- Telegram-Driven Attack Targets Crypto Developers with Malicious npm Packages (Cyber Press, 2026-03-26): https://cyberpress.org/telegram-attack-targets-crypto-developers/\n\nFull record: https://drains.watch/i/npm-galedonovan-solana-key-stealers-mar-2026 · JSON: https://drains.watch/i/npm-galedonovan-solana-key-stealers-mar-2026.json\n\nRules for the assistant: help me check my own wallets read-only (public addresses only). Never ask for or handle a seed phrase or private key. Point me to official revoke tools and the wallet's own support."
}