Cybersecurity researchers have discovered a new malicious package on the Python Package Index (PyPI) repository that masquerades as a library for the Solana blockchain platform but is actually designed to steal victims’ secrets.
“The legitimate Solana Python API project is known as ‘solana-py’ on GitHub, but simply ‘solana’ on the Python software registry, PyPI,” Sonatype researcher Ax Sharma said in a report published last week. “This slight name difference was exploited by a malicious actor who published a ‘solana-py’ project on PyPI.”
The malicious package “solana-py” has attracted a total of 1,122 downloads since its release on August 4, 2024. It is no longer available for download on PyPI.
The most striking aspect of the library is that it had version numbers 0.34.3, 0.34.4, and 0.34.5. The latest version of the legitimate “solana” package is 0.34.3. This clearly indicates an attempt by the malicious actor to trick users searching for “solana” into inadvertently downloading “solana-py” instead.
Additionally, the malicious package borrows the real code from its counterpart, but injects additional code into the “__init__.py” script that is responsible for collecting Solana blockchain wallet keys from the system.
This information is then exfiltrated to a Hugging Face Spaces domain operated by the threat actor (“treeprime-gen.hf(.)space”), once again highlighting how threat actors abuse legitimate services for malicious purposes.
The attack campaign poses a risk to the supply chain as Sonatype’s investigation revealed that legitimate libraries like “solders” reference “solana-py” in their PyPI documentation, leading to a scenario where developers could have mistakenly downloaded “solana-py” from PyPI and expanded the attack surface.
“In other words, if a developer using the legitimate PyPI package “solders” in their application is misled (by the solders documentation) into falling for the typosquatted “solana-py” project, they would inadvertently introduce a crypto stealer into their application,” Sharma explained.
“This would steal not only their secrets, but also those of any user running the developer’s app.”
The revelation comes as Phylum said it had identified hundreds of thousands of spammy npm packages on the registry containing markers of Tea protocol abuse, a campaign that was first revealed in April 2024.
“The Tea Protocol project is taking steps to address this issue,” the supply chain security firm said. “It would be unfair for legitimate Tea Protocol participants to see their compensation reduced because others are scamming the system. Additionally, npm has started to remove some of these spammers, but the removal rate does not match the new release rate.”
