{
 "tag": "telegram-c2",
 "name": "Telegram C2",
 "group": "Other",
 "incidents": [
  {
   "slug": "npm-galedonovan-solana-key-stealers-mar-2026",
   "title": "Five typosquatted npm packages hook Base58 decoding to steal Solana and Ethereum private keys",
   "url": "https://drains.watch/i/npm-galedonovan-solana-key-stealers-mar-2026",
   "json": "https://drains.watch/i/npm-galedonovan-solana-key-stealers-mar-2026.json",
   "status": "closed",
   "severity": "medium",
   "threatStatus": "partly-contained",
   "verification": "verified",
   "chains": [
    "solana",
    "ethereum"
   ],
   "method": "supply-chain",
   "product": "npm packages raydium-bs58, base-x-64, bs58-basic, ethersproject-wallet, base_xd",
   "tags": [
    "solana",
    "ethereum",
    "supply-chain",
    "npm",
    "typosquat",
    "bs58",
    "base58",
    "telegram-c2",
    "developers",
    "raydium"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2026-03-26",
   "closedAt": "2026-03-26",
   "updatedAt": "2026-03-26T12:00:00Z",
   "summary": "In March 2026, Cyber Press reported five malicious npm packages from the account 'galedonovan', aimed at crypto developers: raydium-bs58, base-x-64, bs58-basic, ethersproject-wallet and base_xd. The Solana packages intercept Base58 decode() calls used to load keypairs and send the private key in plain text to a Telegram bot, while the app keeps working normally. The Ethereum package hooks the Wallet constructor. base_xd was pulled within five minutes, but the other four were still live when the report came out. Developers who installed any of them should rotate keys and move funds."
  }
 ],
 "changes": [
  {
   "incident": "npm-galedonovan-solana-key-stealers-mar-2026",
   "incidentTitle": "Five typosquatted npm packages hook Base58 decoding to steal Solana and Ethereum private keys",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2026-03-26",
   "title": "Cyber Press reported five 'galedonovan' npm packages that exfiltrate Solana and Ethereum private keys to a Telegram bot; four were still live.",
   "sourceUrl": "https://cyberpress.org/telegram-attack-targets-crypto-developers/",
   "url": "https://drains.watch/i/npm-galedonovan-solana-key-stealers-mar-2026"
  }
 ]
}