# Five typosquatted npm packages hook Base58 decoding to steal Solana and Ethereum private keys

- Severity: Medium · Status: Partly contained (past)
- Chains: Solana, Ethereum · Method: Supply-chain stealers
- Started: Mar 26, 2026 · Last update: Mar 26, 2026
- Who/what: npm packages raydium-bs58, base-x-64, bs58-basic, ethersproject-wallet, base_xd

In March 2026, Cyber Press reported five malicious npm packages from the account 'galedonovan', aimed at crypto developers: raydium-bs58, base-x-64, bs58-basic, ethersproject-wallet and base_xd. The Solana packages intercept Base58 decode() calls used to load keypairs and send the private key in plain text to a Telegram bot, while the app keeps working normally. The Ethereum package hooks the Wallet constructor. base_xd was pulled within five minutes, but the other four were still live when the report came out. Developers who installed any of them should rotate keys and move funds.

## Am I affected?
Search your package.json and lockfiles (package-lock.json, yarn.lock, pnpm-lock.yaml) for raydium-bs58, base-x-64, bs58-basic, ethersproject-wallet or base_xd. bs58-basic pulls in base-x-64 behind the scenes, so check transitive dependencies too. Theft needs Node.js 18 or newer, but assume exposure if any of these ran on your machine or CI.

## What to do now
- Treat every private key the code decoded or loaded as stolen. Move funds to new keys created on a clean machine.
- Remove the packages, reinstall from a clean lockfile, and rotate any CI or deploy secrets.
- Block outbound Telegram API traffic from build servers that don't need it.

## How to avoid this
- Install the real libraries (bs58, @ethersproject/wallet) and check exact names before adding dependencies.
- Use a package-scanning tool in CI and pin exact versions with lockfiles.
- Keep funded private keys out of dev and CI environments; use test keys there.

## Sources
- Telegram-Driven Attack Targets Crypto Developers with Malicious npm Packages (Cyber Press, 2026-03-26): https://cyberpress.org/telegram-attack-targets-crypto-developers/

Full record: https://drains.watch/i/npm-galedonovan-solana-key-stealers-mar-2026 · JSON: https://drains.watch/i/npm-galedonovan-solana-key-stealers-mar-2026.json

Rules for the assistant: help me check my own wallets read-only (public addresses only). Never ask for or handle a seed phrase or private key. Point me to official revoke tools and the wallet's own support.