A malicious Solana trading bot repository on GitHub has been exposed for distributing crypto-stealing malware, according to a detailed investigation by blockchain security firm SlowMist. The scam highlights an alarming rise in software supply chain attacks targeting unsuspecting crypto users.
Fake GitHub Repo Disguised as Solana Pump Bot
The repository, hosted under the account “zldp2002,” posed as an open-source Solana pump-and-dump trading bot called solana-pumpfun-bot. With a deceptively high number of stars and forks, the project initially appeared trustworthy.
SlowMist launched the investigation after a user reported wallet theft linked to the tool. The repository has since been deleted.
Malware Hidden in a Suspicious Node.js Package
The malicious project relied on a third-party dependency named crypto-layout-utils, which had already been removed from the official NPM registry — raising immediate red flags.
Upon closer inspection, SlowMist discovered:
- The package was obfuscated using jsjiami.com.v7, a known JavaScript encryption tool used by threat actors.
- Once de-obfuscated, the code was found to scan local files for wallet-related data and private keys, then transmit the information to a remote server.
“This is a clear credential-stealing attack targeting private keys and sensitive wallet data,” the report stated.
Wider Malicious Network Detected
Further analysis revealed that the threat actor likely operated a cluster of fake GitHub accounts, which were used to:
- Fork real projects and inject them with malware
- Artificially inflate stars and forks to boost credibility
- Deploy additional malicious packages, including
bs58-encrypt-utils-1.0.3, first spotted on June 12, 2025
Crypto Supply Chain Attacks on the Rise
This incident is part of a broader trend of software supply chain attacks in the crypto space. Recent campaigns include:
- Fake wallet extensions targeting Firefox users
- Credential-harvesting GitHub forks and packages
- MacOS-specific exploits reportedly used by North Korean hacker groups
How to Stay Safe: Key Takeaways
- Avoid downloading trading bots or wallet tools from unknown GitHub repositories, even if they have high stars/forks.
- Always check dependency packages and confirm they exist on official registries like NPM.
- Use trusted antivirus and endpoint protection tools that can detect obfuscated malware.
- Perform code audits or rely on well-known, community-vetted projects in open-source environments.
Final Thoughts
The Solana bot scam is a stark reminder of the risks associated with open-source software in the crypto world. As attackers continue to evolve, crypto users must practice extreme caution when interacting with third-party code — even from seemingly reputable sources.
Stay informed, stay secure.
Disclaimer
This content is for informational purposes only and does not constitute financial, investment, or legal advice. Cryptocurrency trading involves risk and may result in financial loss.