# PhantomSync: 8 npm packages drop a persistent crypto wallet stealer

> Between 2026-07-13 and 2026-07-14 the npm publisher `solbuilder_io` (angel_lopez89@proton.me) shipped eight small crypto-developer packages - `base58-utils`, `abi-encode`, `eth-dev`, `arb-kit`, `layer2-sdk`, `solana-key-utils`, `eth-wallet-helpers`, `crypto-validate-lib` - each carrying a working utility plus a self-invoking dropper that fires ~37s after import, installs cross-platform persistence, and launches an RSA-4096 crypto-wallet stealer exfiltrating to public IPFS. npm-support unpublished every version on 2026-07-14 17:23 UTC.

- Published: 2026-07-14
- Severity: high
- Kind: Malicious package - A package that was malicious from its first publish under its own name - a fake tool, a lure used in a social-engineering campaign, or a trojanised utility - rather than a copy of an existing name.
- Ecosystems: npm
- Scope: 8 packages, 31 compromised versions
- Tags: infostealer, credential-theft, crypto-wallet-drain, obfuscation
- Also known as: PhantomSync, solbuilder_io cluster
- Detected by: Xygeni
- Incident ID: npm-2026-07-14-phantomsync-crypto-wallet-dropper

## Affected packages (8)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [abi-encode](https://dependencywatch.io/package/npm/abi-encode) | npm | 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4 |
| [arb-kit](https://dependencywatch.io/package/npm/arb-kit) | npm | 1.0.0, 1.0.1 |
| [base58-utils](https://dependencywatch.io/package/npm/base58-utils) | npm | 1.0.0, 1.0.1, 1.0.3, 1.0.4, 1.0.5 |
| [crypto-validate-lib](https://dependencywatch.io/package/npm/crypto-validate-lib) | npm | 1.0.0, 1.0.1, 1.0.2, 1.0.3 |
| [eth-dev](https://dependencywatch.io/package/npm/eth-dev) | npm | 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4 |
| [eth-wallet-helpers](https://dependencywatch.io/package/npm/eth-wallet-helpers) | npm | 1.0.0, 1.0.1, 1.0.2, 1.0.3 |
| [layer2-sdk](https://dependencywatch.io/package/npm/layer2-sdk) | npm | 1.0.0, 1.0.1 |
| [solana-key-utils](https://dependencywatch.io/package/npm/solana-key-utils) | npm | 1.0.0, 1.0.1, 1.0.2, 1.0.3 |

## What happened

Xygeni tied eight npm packages published between 2026-07-13 21:28 UTC and 2026-07-14 13:59 UTC to a single throwaway publisher - `solbuilder_io`, contact `angel_lopez89[@]proton[.]me`, with no verified GitHub identity. Every package name reads like a normal crypto-developer utility - `base58-utils`, `abi-encode`, `eth-dev`, `arb-kit`, `layer2-sdk`, `solana-key-utils`, `eth-wallet-helpers`, `crypto-validate-lib` - and each package actually contains a working implementation of the advertised primitive, which is what gets it past a casual review.

## Dropper mechanics

Appended after the working utility is a self-invoking block that runs the moment the module is `require()`d - this is a runtime execution, not an install-time `postinstall` hook, so `npm install --ignore-scripts` and Verdaccio postinstall-blocking rules do NOT stop it. Roughly 37 seconds after import the block decodes a payload shipped inside the package as a fake test fixture, writes it to a hidden dotfile under the user's home directory, registers itself to relaunch on every login across Windows (Registry Run keys), macOS (LaunchAgents), and Linux (autostart / systemd user unit), and spawns the decoded script as a detached process. The 37-second delay is calibrated to outlast short-lived CI sandboxes that terminate before persistence is written.

## Second stage - crypto-wallet & secrets stealer

The second stage waits for the host to sit idle, then walks the home directory looking for wallet material and developer secrets: Solana keypairs under `~/.config/solana`, Ethereum keystore JSON under `~/.ethereum/keystore`, raw Ethereum private keys, Bitcoin WIF keys, BIP-39 seed phrases, SSH private keys, and secret-bearing environment variables. Each hit is encrypted with a hardcoded RSA-4096 key and pinned to public IPFS storage - takedown of one gateway does not recover the drops. The stealer beacons back every 12 hours to check for updated instructions.

## Registry timeline

- **2026-07-13 21:28 UTC** - first three packages appear (`solana-key-utils@1.0.0`, `eth-wallet-helpers@1.0.0`, `crypto-validate-lib@1.0.0`).
- **2026-07-14 01:23–02:19 UTC** - remaining five packages published; each package cycles through 2–5 rapid patch versions over ~12 hours (final tags include `base58-utils@1.0.5`, `abi-encode@1.0.4`, `eth-dev@1.0.4`).
- **2026-07-14 17:23 UTC** - npm-support unpublishes every published version of all eight packages. Registry entries now return the packages with an empty version tree.

## Related activity

Xygeni disclosed this cluster in *Malicious Code Digest 79* alongside the bingo-ai PyPI velocity anomaly (~80 versions in 30 minutes) and the ongoing @wagni_bot-scope crypto-SDK impersonation wave from earlier in July. PhantomSync is a companion to the June 2026 `polymarket-clob-math` Vercel-loader (`GHSA-3q5w-m6wr-5jp2`, tracked separately) - same author profile (throwaway ProtonMail publisher, no verified source-control identity) but a different execution path (delayed post-require dropper vs. install-time Vercel fetcher).

## Impact

- Import-time (not install-time) execution - the dropper hides behind a working utility so `npm install --ignore-scripts` does not stop it; the payload fires the first time app code `require`/`import`s any of the 8 packages
- ~37-second delay before staging - designed to slip past sandbox / short-lived CI runners that terminate before the payload is written to disk
- Cross-platform persistence installed on Windows, macOS, and Linux - the decoded script registers a login-time restart, so a single import compromises the developer laptop until the persistence hooks are removed
- Crypto-wallet key theft - Solana keypairs (`~/.config/solana`), Ethereum keystores (`~/.ethereum/keystore`), Bitcoin WIF keys, and BIP-39 seed phrases are walked out of the home directory
- Broader credential theft - SSH private keys and any secret-bearing environment variables are collected in the same sweep
- Findings are RSA-4096-encrypted and pinned to public IPFS storage - takedown of any single gateway does not stop retrieval; the operator beacons back every 12 hours to fetch new drops

## What to do

1. Grep `package.json`, lockfiles, CI image layers, and internal Verdaccio/Nexus/Artifactory caches for any of the 8 package names; delete every reference - npm-support has already unpublished them so `npm install` will hard-fail otherwise
2. On any developer laptop or CI runner that imported one of these packages, treat as fully compromised: rotate crypto-wallet seed phrases and private keys, SSH keys, cloud CLI tokens, and any secret-bearing environment variables from a separate clean device
3. Audit persistence: check login items on macOS (`~/Library/LaunchAgents`), Registry Run keys and Startup folder on Windows, and `~/.config/autostart` + systemd user units on Linux for entries created since 2026-07-13
4. Grep host telemetry for outbound HTTPS to public IPFS gateways (`ipfs.io`, `cf-ipfs.com`, `dweb.link`, `gateway.pinata.cloud`) originating from Node processes or persisted background scripts since 2026-07-13
5. For Solana / Ethereum project teams: enforce scoped-name policies (`@solana/*`, `@ethereum-attestation/*`) in linting so unscoped lookalikes like `solana-key-utils` cannot autocomplete-blind into a lockfile

## Check your own dependencies

- Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [PhantomSync: eight crypto-developer npm packages hide a delayed, self-persisting dropper](https://xygeni.io/blog/phantomsync-npm-crypto-wallet-stealer/) - Xygeni
- [Xygeni Malicious Code Digest 79 - July 10–17 npm/PyPI recap](https://xygeni.io/blog/xygeni-malicious-code-digest-79/) - Xygeni
- [base58-utils on the npm registry (all versions unpublished)](https://registry.npmjs.org/base58-utils) - npm
- [eth-wallet-helpers on the npm registry (all versions unpublished)](https://registry.npmjs.org/eth-wallet-helpers) - npm

---

Canonical page: https://dependencywatch.io/incident/npm-2026-07-14-phantomsync-crypto-wallet-dropper
Markdown version: https://dependencywatch.io/incident/npm-2026-07-14-phantomsync-crypto-wallet-dropper.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).