TI-2024-36250 Aliases CVE-2024-54134 GHSA-jcxm-7wvp-g6p5

@solana/web3.js modified package published to npm, containing malware that exfiltrates private key material

LOW 37CWE-200Published 2024-12-04 · Updated 2024-12-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: Passive
Attack complexity: Low
Attack requirements: None
Impact type: Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-200.

Summary

A publish-access account was compromised for `@solana/web3.js`, a JavaScript library that is commonly used by Solana dapps. This allowed an attacker to publish unauthorized and malicious packages that were modified, allowing them to steal private key material and drain funds from dapps, like bots, that handle private keys directly. This issue should not affect non-custodial wallets, as they generally do not expose private keys during transactions. This is not an issue with the Solana protocol itself, but with a specific JavaScript client library and only appears to affect projects that directly handle private keys and that updated within the window of 3:20pm UTC and 8:25pm UTC on Tuesday, December 3, 2024. These two unauthorized versions (1.95.6 and 1.95.7) were caught within hours and have since been unpublished. All Solana app developers should upgrade to version 1.95.8. Developers that suspect they might be compromised should rotate any suspect authority keys, including multisigs, program authorities, server keypairs, and so on.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00543 45th percentileScored 2026-11-07

Fix Fixed solana-web3.js (solana-labs): 1.95.8@solana/web3.js (npm): 1.95.8

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
solana-labs	solana-web3.js	1.95.6 to before 1.95.8	1.95.8	Patch available	CNA
—	@solana/web3.js (npm)	1.95.6 to before 1.95.8	1.95.8	Patch available	GHSA-jcxm-7wvp-g6p5

solana-web3.js Vendorsolana-labs Affected 1.95.6 to before 1.95.8 Fixed in 1.95.8 Patch available CNA
@solana/web3.js (npm) Vendor— Affected 1.95.6 to before 1.95.8 Fixed in 1.95.8 Patch available GHSA-jcxm-7wvp-g6p5

Remediation

Fix · CNA solana-web3.js (solana-labs) Fixed in 1.95.8
Fix · GHSA-jcxm-7wvp-g6p5 @solana/web3.js (npm) Fixed in 1.95.8 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2024-54134
2026-10-03 Alias added: GHSA-jcxm-7wvp-g6p5

References

Advisory 2

Other 2

TI-2022-07239 Solana rBPF - Incorrect Calculation in sdiv instruction CVSS 3.1CRITICAL 9.1
TI-2024-19999 Handling untrusted input can result in a crash, leading to loss of availability / denial of service CVSS 3.1HIGH 7.5
TI-2021-21061 From version 0.2.14 to 0.2.16 for Solana rBPF, function "relocate" in the file src/elf.rs… CVSS 3.1HIGH 7.5
TI-2022-13297 Solana solana_rbpf before 0.2.29 has an addition integer overflow via invalid ELF program… CVSS 3.1HIGH 7.5
TI-2022-16344 Weakness in Transfer Validation Logic in @solana/pay CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences