FakeFix Campaign Uses 25 Malicious npm and PyPI Packages to Steal Solana Developer Secrets

Key Takeaways

• A sophisticated supply chain attack, dubbed “Solana FakeFix,” is actively targeting Solana developers and Windows users through malicious packages on npm and PyPI.
• The campaign leverages 25 deceptive packages designed to steal sensitive information, including Solana wallet keys, cloud credentials, SSH keys, and other developer secrets.
• Attackers employ convincing lures, mimicking legitimate Solana tooling and using GitHub issue spam to promote the malicious packages as community fixes.
• The threat involves two primary clusters: one focused on Solana credential theft, and another deploying hidden Windows executables for persistent remote access.
• JFrog Security Research uncovered the campaign, providing detailed indicators of compromise and urging immediate mitigation actions for affected developers.

A perilous supply chain operation is actively compromising Solana developers and other users by injecting malicious code into counterfeit software packages. These deceptive packages, distributed across both the npm and PyPI registries, are designed to exfiltrate critical developer secrets. This ongoing campaign, identified as “Solana FakeFix,” involves 25 malicious packages, as detailed in a comprehensive report by JFrog Security Research.

The attackers have demonstrated a high degree of sophistication in their methods, particularly in crafting convincing lures. Rather than using arbitrary names, the threat actors meticulously named their packages to closely resemble authentic Solana development tools, such as solana-web3-stable, solana-rpc-client, and @solana-labs/web3.js. This tactic specifically targets developers encountering build issues or dependency conflicts, making the malicious packages appear as legitimate solutions rather than threats.

JFrog’s analysis segmented the operation into two distinct clusters. The primary “Solana FakeFix” group comprises 20 packages aimed at Solana developers, while a secondary “CMS-themed” cluster of 5 packages is designed to deploy hidden Windows executables on compromised systems. The campaign exhibits an evolving technical approach, with earlier versions relying on basic install-time scripts. Later iterations incorporated fully functional Solana bundles, injecting stealthy stealer code after legitimate exports, significantly complicating detection efforts.

The threat actor also actively promoted these packages through GitHub issue spam, creating nine issues across various projects. These posts deceptively framed the malicious packages as community-driven fixes for the genuine Solana SDK.

The overall campaign encompasses 16 malicious npm packages and 4 PyPI packages under the FakeFix banner, alongside 5 additional npm packages within the CMS loader group. Each package was engineered to appear legitimate and functional during initial testing while simultaneously executing a covert stealer payload in the background.

Solana FakeFix Campaign: Modus Operandi

The malicious packages employ distinct delivery mechanisms tailored to their respective platforms. On npm, a postinstall lifecycle hook automatically triggered a JavaScript payload upon a developer executing an install command, requiring no further interaction. For PyPI packages, the malicious code resided within the __init__.py file, activating immediately when the package was imported into any script, notebook, or test environment.

Upon activation, the payload initiates a search for a broad range of sensitive data. This includes Solana keypair files, SSH private keys, AWS credential files, .env files, and environment variables containing keywords such as KEY, SECRET, MNEMONIC, or PASSWORD. All exfiltrated data is then transmitted in real-time to a Telegram bot controlled by the attacker.

More advanced iterations of these packages establish persistent backdoors that periodically communicate with Telegram for remote commands. This persistent access allows the attacker to retrieve additional SSH keys, extract environment variables, or execute arbitrary shell commands on the victim’s machine. One particularly aggressive variant attempts to drain the victim’s Solana funds and redirect local RPC settings, transforming a one-time data theft into a persistent remote access and financial exploitation threat.

The actor also distributed a fraudulent MEV bot package named solana-mev-bot. This package used social engineering to prompt users to directly input their Solana private key, masquerading as an automated profit-generating tool to phish the critical credential needed to completely empty a wallet.

CMS Windows Loader: A Second Hidden Cluster

The second cluster of the campaign specifically targets Windows developers with an entirely different payload family. Packages like cms-storehub, cms-helpgit, and cms-github utilize npm install-time PowerShell scripts. These scripts are designed to install the Deno runtime and fetch remote JavaScript code from an attacker-controlled server.

The loader achieves persistence through Windows Registry Run keys and continuously retrieves a dynamic second-stage payload at 30-second intervals. Two other packages, to-cms and shopifyto-cms, function as download-and-execute droppers. These packages retrieve a Windows executable, launch it from the temporary directory, and then attempt to remove traces of their activity. The attacker’s server also receives registration telemetry, providing the operator with a live overview of compromised systems.

What You Should Do

• Remove Affected Packages: Immediately uninstall any identified malicious packages from your development environments.
• Rotate Credentials: Promptly rotate all Solana wallet keys, cloud credentials (AWS, etc.), SSH keys, and any other secrets that may have been exposed.
• Audit Systems for Persistence: Thoroughly audit all development machines for persistence artifacts, including Windows Registry Run keys, scheduled tasks, and crontab entries.
• Rebuild CI/CD Runners: It is strongly recommended to rebuild Continuous Integration/Continuous Deployment (CI/CD) runners and other critical development infrastructure from clean, trusted images, rather than relying solely on package removal.
• Exercise Extreme Caution: Treat any package that attempts to initiate network connections during installation or execute hidden PowerShell scripts as a significant red flag.
• Verify Package Authenticity: Always verify the authenticity and integrity of packages before installation, especially those from less familiar sources or those claiming to be “fixes.”

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.