Weaponized PyPI Package Targets Developers to Steal Source Code

Security researchers at RL have discovered a malicious Python package called “solana-token” on PyPI that is intended to prey on developers working with the Solana blockchain, serving as a terrifying reminder of the ongoing hazards that lurk in the open-source software environment.

This package, which masqueraded as a utility for blockchain application development, was downloaded over 600 times before its removal, highlighting the growing sophistication of software supply chain attacks targeting the cryptocurrency community.

The incident underscores the urgent need for vigilance among developers who rely on third-party libraries, as attackers increasingly weaponize seemingly legitimate tools to exfiltrate sensitive data and compromise secure environments.

A Deceptive Tool with Malicious Intent

The solana-token package presented itself as a developer aid for Solana, a high-speed, low-cost blockchain platform launched in 2017 by Solana Labs and managed by the Solana Foundation.

However, beneath its innocuous facade, the package harbored sinister functionality.

According to RL’s analysis, it exhibited several hallmarks of malicious software, including hardcoded URLs referencing hosts by IP addresses to obscure communication with command-and-control servers, outbound connections to non-standard ports, and file-reading behaviors indicative of infostealer malware.

Most alarmingly, a specific method within the package was engineered to scan the Python execution stack, extract source code from files in the execution chain, and transmit this data to a remote server.

The primary objective appears to be the theft of hardcoded cryptographic secrets-such as private keys or access credentials to cryptocurrency wallets-embedded within developers’ codebases, making this attack a precursor to potentially devastating breaches.

This is not the first instance of a package named solana-token being flagged as malicious.

A year prior, a similarly named package with different version numbers (1.0.1 and 1.0.2 compared to the latest 0.0.1 and 0.0.2) was detected and voluntarily removed by its authors, not PyPI security administrators, leaving the name available for reuse.

While RL lacks definitive proof that the same threat actors are behind both campaigns, the recurrence of the package name raises suspicions.

Following RL’s report, PyPI administrators have now removed the latest iteration, which should prevent further uploads under this moniker.

This incident parallels earlier campaigns like “BIPClip” in 2024, where seven PyPI packages targeting BIP39 mnemonic phrases for crypto wallet recovery were downloaded nearly 7,500 times, showcasing a persistent trend of targeting crypto developers.

A Growing Threat in the Crypto Supply Chain

The discovery of solana-token reinforces the escalating risk of supply chain attacks within the cryptocurrency sector.

Unlike recent exploits targeting end-user applications like Atomic and Exodus wallets, this package explicitly zeros in on developers, aiming to harvest application code and embedded secrets as a stepping stone for broader attacks.

Such tactics exploit the trust developers place in open-source repositories, turning tools meant to streamline innovation into vectors for compromise.

RL urges development teams to intensify monitoring for suspicious behaviors-such as unexpected network activity or unauthorized file access-in both open-source and commercial third-party modules.

By intercepting malicious code before it infiltrates secure environments, organizations can thwart destructive attacks and safeguard critical infrastructure.

Indicators of Compromise (IOCs)