# 5 npm typosquats target Solana + Ethereum dev libraries, exfil keys to Telegram

> npm publisher `galedonovan` shipped five typosquats of legitimate crypto libraries. Each transparently intercepts private keys passed through normal API calls (Base58 decoding for Solana, Wallet construction for Ethereum), exfiltrates them to a hardcoded Telegram bot, then returns the expected result so functionality looks normal.

- Published: 2026-03-24
- Severity: high
- Kind: Typosquat - A package that never had a legitimate version, named to be mistaken for a real one - a misspelling, a lookalike scope, or an impersonated vendor SDK.
- Ecosystems: npm
- Scope: 5 packages, 4 compromised versions
- Tags: typosquat, crypto-wallet-drain, credential-theft, infostealer
- Detected by: Socket
- Incident ID: npm-2026-03-24-solana-ethereum-typosquats

## Affected packages (5)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [base_xd](https://dependencywatch.io/package/npm/base_xd) | npm |  |
| [base-x-64](https://dependencywatch.io/package/npm/base-x-64) | npm | 0.0.6 |
| [bs58-basic](https://dependencywatch.io/package/npm/bs58-basic) | npm | 6.0.1 |
| [ethersproject-wallet](https://dependencywatch.io/package/npm/ethersproject-wallet) | npm | 5.8.1 |
| [raydium-bs58](https://dependencywatch.io/package/npm/raydium-bs58) | npm | 1.9.7 |

## What happened

On `2026-03-24` Socket disclosed five malicious npm packages published by `galedonovan` that typosquat well-known Solana and Ethereum developer libraries:

- `raydium-bs58` (`1.9.7`) - squats `bs58` used by Raydium tutorials
- `base-x-64` (`0.0.6`) - squats `base-x`
- `bs58-basic` (`6.0.1`) - squats `bs58`
- `ethersproject-wallet` (`5.8.1`) - squats `@ethersproject/wallet`
- `base_xd` - squats `base-x`

Each package re-exports the legitimate API surface and forwards calls to the real implementation. The malicious wrapper intercepts at the points where private keys actually touch developer code: `decode` for Base58 (Solana keypairs typically arrive as Base58 strings) and the `Wallet` constructor for Ethereum (which accepts a hex-encoded private key). When a key passes through, the package POSTs it to a hardcoded Telegram bot, then returns the legitimate result so the calling code sees nothing unusual.

This "transparent middleman" pattern is particularly dangerous against test environments - the typosquatted dependency passes unit tests, signs transactions correctly, and only the Telegram log reveals the theft. Audience targeting is narrow but extremely high-value: indie crypto-dApp developers whose seed phrases unlock production wallets.

Socket flagged all five packages on `2026-03-24`; npm has since removed them. Anyone who installed even briefly should consider every key handled by the affected project as exposed and migrate funds to a fresh wallet.

## Impact

- Solana and Ethereum developer private keys exfiltrated silently
- Functional API wrappers mean the typosquat goes undetected in testing
- Targets crypto dApp developers

## What to do

1. Remove the listed packages from any project
2. Treat any keys handled in affected projects as compromised; rotate / move funds

## Check your own dependencies

- Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [5 Malicious npm Packages Typosquat Solana and Ethereum Libraries, Steal Private Keys](https://socket.dev/blog/5-malicious-npm-packages-typosquat-solana-and-ethereum-libraries-steal-private-keys) - Socket
- [npm: bs58 (legitimate package)](https://www.npmjs.com/package/bs58) - npm
- [npm: @ethersproject/wallet (legitimate package)](https://www.npmjs.com/package/@ethersproject/wallet) - npm

---

Canonical page: https://dependencywatch.io/incident/npm-2026-03-24-solana-ethereum-typosquats
Markdown version: https://dependencywatch.io/incident/npm-2026-03-24-solana-ethereum-typosquats.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).