DependencyWatch.io
Talk to PrecursorScan a lockfile

PhantomSync: 8 npm packages drop a persistent crypto wallet stealer

HighMalicious packagenpm

Between 2026-07-13 and 2026-07-14 the npm publisher solbuilder_io (angel_lopez89@proton.me) shipped eight small crypto-developer packages - base58-utils, abi-encode, eth-dev, arb-kit, layer2-sdk, solana-key-utils, eth-wallet-helpers, crypto-validate-lib - each carrying a working utility plus a self-invoking dropper that fires ~37s after import, installs cross-platform persistence, and launches an RSA-4096 crypto-wallet stealer exfiltrating to public IPFS. npm-support unpublished every version on 2026-07-14 17:23 UTC.

Published 14 Jul 2026

Check your package-lock.jsonSource advisory
At a glancenpm-2026-07-14-phantomsync-crypto-wallet-dropper
8
Packages tracked31 malicious versions

Every version named by the advisory is in the scanner, so a lockfile check finds it directly.

Severity
High
Type
Malicious package
Published
14 Jul 2026
Ecosystems
npm
Detected by
Xygeni
Also known as
PhantomSync, solbuilder_io cluster
Source
xygeni.io

Malicious package. A package that was malicious from its first publish under its own name - a fake tool, a lure used in a social-engineering campaign, or a trojanised utility - rather than a copy of an existing name.

What happened

The full picture

Xygeni tied eight npm packages published between 2026-07-13 21:28 UTC and 2026-07-14 13:59 UTC to a single throwaway publisher - solbuilder_io, contact angel_lopez89[@]proton[.]me, with no verified GitHub identity. Every package name reads like a normal crypto-developer utility - base58-utils, abi-encode, eth-dev, arb-kit, layer2-sdk, solana-key-utils, eth-wallet-helpers, crypto-validate-lib - and each package actually contains a working implementation of the advertised primitive, which is what gets it past a casual review.

Dropper mechanics

Appended after the working utility is a self-invoking block that runs the moment the module is require()d - this is a runtime execution, not an install-time postinstall hook, so npm install --ignore-scripts and Verdaccio postinstall-blocking rules do NOT stop it. Roughly 37 seconds after import the block decodes a payload shipped inside the package as a fake test fixture, writes it to a hidden dotfile under the user's home directory, registers itself to relaunch on every login across Windows (Registry Run keys), macOS (LaunchAgents), and Linux (autostart / systemd user unit), and spawns the decoded script as a detached process. The 37-second delay is calibrated to outlast short-lived CI sandboxes that terminate before persistence is written.

Second stage - crypto-wallet & secrets stealer

The second stage waits for the host to sit idle, then walks the home directory looking for wallet material and developer secrets: Solana keypairs under ~/.config/solana, Ethereum keystore JSON under ~/.ethereum/keystore, raw Ethereum private keys, Bitcoin WIF keys, BIP-39 seed phrases, SSH private keys, and secret-bearing environment variables. Each hit is encrypted with a hardcoded RSA-4096 key and pinned to public IPFS storage - takedown of one gateway does not recover the drops. The stealer beacons back every 12 hours to check for updated instructions.

Registry timeline

  • 2026-07-13 21:28 UTC - first three packages appear (solana-key-utils@1.0.0, eth-wallet-helpers@1.0.0, crypto-validate-lib@1.0.0).
  • 2026-07-14 01:23–02:19 UTC - remaining five packages published; each package cycles through 2–5 rapid patch versions over ~12 hours (final tags include base58-utils@1.0.5, abi-encode@1.0.4, eth-dev@1.0.4).
  • 2026-07-14 17:23 UTC - npm-support unpublishes every published version of all eight packages. Registry entries now return the packages with an empty version tree.

Related activity

Xygeni disclosed this cluster in Malicious Code Digest 79 alongside the bingo-ai PyPI velocity anomaly (~80 versions in 30 minutes) and the ongoing @wagni_bot-scope crypto-SDK impersonation wave from earlier in July. PhantomSync is a companion to the June 2026 polymarket-clob-math Vercel-loader (GHSA-3q5w-m6wr-5jp2, tracked separately) - same author profile (throwaway ProtonMail publisher, no verified source-control identity) but a different execution path (delayed post-require dropper vs. install-time Vercel fetcher).

infostealercredential-theftcrypto-wallet-drainobfuscation
Affected packages

8 packages 31 versions

These are usually pulled in as transitive dependencies rather than installed directly. Check your whole tree at once. It runs in your browser and nothing is uploaded.

Check package-lock.json →
Impact

What it does if you installed it

  • Import-time (not install-time) execution - the dropper hides behind a working utility so npm install --ignore-scripts does not stop it; the payload fires the first time app code require/imports any of the 8 packages
  • ~37-second delay before staging - designed to slip past sandbox / short-lived CI runners that terminate before the payload is written to disk
  • Cross-platform persistence installed on Windows, macOS, and Linux - the decoded script registers a login-time restart, so a single import compromises the developer laptop until the persistence hooks are removed
  • Crypto-wallet key theft - Solana keypairs (~/.config/solana), Ethereum keystores (~/.ethereum/keystore), Bitcoin WIF keys, and BIP-39 seed phrases are walked out of the home directory
  • Broader credential theft - SSH private keys and any secret-bearing environment variables are collected in the same sweep
  • Findings are RSA-4096-encrypted and pinned to public IPFS storage - takedown of any single gateway does not stop retrieval; the operator beacons back every 12 hours to fetch new drops
What to do

Clean-up steps

  1. Grep package.json, lockfiles, CI image layers, and internal Verdaccio/Nexus/Artifactory caches for any of the 8 package names; delete every reference - npm-support has already unpublished them so npm install will hard-fail otherwise
  2. On any developer laptop or CI runner that imported one of these packages, treat as fully compromised: rotate crypto-wallet seed phrases and private keys, SSH keys, cloud CLI tokens, and any secret-bearing environment variables from a separate clean device
  3. Audit persistence: check login items on macOS (~/Library/LaunchAgents), Registry Run keys and Startup folder on Windows, and ~/.config/autostart + systemd user units on Linux for entries created since 2026-07-13
  4. Grep host telemetry for outbound HTTPS to public IPFS gateways (ipfs.io, cf-ipfs.com, dweb.link, gateway.pinata.cloud) originating from Node processes or persisted background scripts since 2026-07-13
  5. For Solana / Ethereum project teams: enforce scoped-name policies (@solana/*, @ethereum-attestation/*) in linting so unscoped lookalikes like solana-key-utils cannot autocomplete-blind into a lockfile
References

Sources

npm-2026-07-14-phantomsync-crypto-wallet-dropperBack to incidentsSubmit a correction
Am I affected?

Check your lockfile against this and every other incident.

Paste a lockfile and it is matched on your own device against every compromised version we track. Nothing is uploaded and there is no account.

Check your package-lock.jsonAll incidents