CVE-2024-54134: Exposure of Sensitive Information to an Unauthorized Actor

A publish-access account was compromised for @solana/web3.js, a JavaScript library that is commonly used by Solana dapps. This allowed an attacker to publish unauthorized and malicious packages that were modified, allowing them to steal private key material and drain funds from dapps, like bots,...

solana/web3.js 信息泄露漏洞

solana/web3.js is a JavaScript library from Solana Labs. An information disclosure vulnerability exists in solana/web3.js versions 1.95.6 and 1.95.7, which stems from a vulnerability that allows an attacker to distribute unauthorized malicious packages that have been modified to steal private key...

Malicious code in @solana/web3.js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 507e136eb7d13bd9c88a5e20d692768a759c2ae382d1ab54ba66c196b560cacb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-11183 Malicious code in @solana/web3.js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 507e136eb7d13bd9c88a5e20d692768a759c2ae382d1ab54ba66c196b560cacb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2024-9247 · Solana · @Solana/Web3.Js

Name of the Vulnerable Software and Affected Versions: @solana/web3.js versions 1.95.6 through 1.95.7 Description: A publish-access account was compromised for @solana/web3.js, a JavaScript library commonly used by Solana dapps. This allowed an attacker to publish unauthorized and malicious...

Malware in solana-web3-helpers

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2024-10622 Malicious code in solana-web3-helpers (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bcf9d5b7aec80f6f8909d8b65170940ecf00b096f922f111da7848b86257088c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

@blockworks-foundation/mango-client (>=3.0.14, <=3.2.23), @frakters/community-pools-client-library-v2 (>=1.0.7, <=1.0.9) +11 more potentially affected by CVE-2024-30253 via @solana/web3.js (1.21.0)

@solana/web3.js NPM version 1.21.0 is affected by a known vulnerability. The following packages have a transitive dependency on @solana/web3.js and may be impacted: - @blockworks-foundation/mango-client =3.0.14, =1.0.7, =1.0.1, =2.2.3, =0.0.6, =1.0.0, =0.0.1, =1.0.0, =1.2.5, =1.0.0, =1.0.0, =0.2....

@fabric-foundation/sdk (>=0.0.65, <=1.0.2-beta.6), @frakt-protocol/frakt-sdk (>=0.0.7, <=0.0.9) +2 more potentially affected by CVE-2024-30253 via @solana/web3.js (1.34.0)

@solana/web3.js NPM version 1.34.0 is affected by a known vulnerability. The following packages have a transitive dependency on @solana/web3.js and may be impacted: - @fabric-foundation/sdk =0.0.65, =0.0.7, =3.0.4, =3.0.6 - @toruslabs/solana-embed 0.1.4 Source cves: CVE-2024-30253 Source advisory...

@aloe2/account-lib (2.20.20228282226), @aloe2/bitgo (14.2.20228282226) +11 more potentially affected by CVE-2024-30253 via @solana/web3.js (>=1.56.0, <=1.56.2)

@solana/web3.js NPM version =1.56.0, =2.20.0, =14.2.0, =1.0.1, =2.0.0-rc.18, =8.0.1, =3.0.0-alpha.12, =3.1.2-beta.0, =2.2.33, =2.0.1-alpha.412, =7.0.0, =8.0.2 Source cves: CVE-2024-30253 Source advisory: OSV:GHSA-8M45-2RJM-J347...

@nikaru-dev/provider-all (>=0.25.1-next.3, <=0.26.0), @nikaru-dev/provider-walletconnect-2 (>=0.18.1-next.2, <=0.19.1-next.0) +11 more potentially affected by CVE-2024-30253 via @solana/web3.js (>=1.67.0, <=1.67.2)

@solana/web3.js NPM version =1.67.0, =0.25.1-next.3, =0.18.1-next.2, =0.20.1-next.9, =0.20.1-next.16, =0.22.1-next.0, =0.14.1-next.5, =0.17.1-next.0, =0.17.1-next.0, =0.22.1-next.9, =0.14.1-next.8, =0.17.1-next.19, =0.17.1-next.30, =0.0.1, =0.1.5 Source cves: CVE-2024-30253 Source advisory:...

@convexitydmcc/wallet-adapter-walletconnect (>=2.0.0-beta.26, <=2.0.0-rc.5), @renec-foundation/gasless-sdk (>=0.2.3, <=0.2.6) +1 more potentially affected by CVE-2024-30253 via @solana/web3.js (1.48.0)

@solana/web3.js NPM version 1.48.0 is affected by a known vulnerability. The following packages have a transitive dependency on @solana/web3.js and may be impacted: - @convexitydmcc/wallet-adapter-walletconnect =2.0.0-beta.26, =0.2.3, =3.0.0-beta.1, =6.3.0-profits-mercurial-rc8 Source cves:...

@brave/wallet-standard-brave (>=0.0.8, <=0.0.12), @oraichain/owallet-wallet-standard (>=0.1.0, <=0.1.1) +1 more potentially affected by CVE-2024-30253 via @solana/web3.js (1.58.0)

@solana/web3.js NPM version 1.58.0 is affected by a known vulnerability. The following packages have a transitive dependency on @solana/web3.js and may be impacted: - @brave/wallet-standard-brave =0.0.8, =0.1.0, =0.1.6, =0.1.10 Source cves: CVE-2024-30253 Source advisory: OSV:GHSA-8M45-2RJM-J347...

@jup-ag/core (>=3.0.0-beta.0, <=3.0.0-beta.8-eacba78), @jup-ag/react-hook (>=3.0.0-beta.0, <=3.0.0-beta.8-eacba78) +7 more potentially affected by CVE-2024-30253 via @solana/web3.js (>=1.63.0, <=1.63.1)

@solana/web3.js NPM version =1.63.0, =3.0.0-beta.0, =3.0.0-beta.0, =0.0.1-38592825.0, =0.0.1-0f199db9.0, =4.0.0-maple-1, =0.1.0, =1.4.8, =1.0.0, =1.7.1-alpha.4 Source cves: CVE-2024-30253 Source advisory: OSV:GHSA-8M45-2RJM-J347...

@chainify/solana (>=1.2.14, <=2.4.1), @liquality/error-parser (>=1.1.0-next.1, <=1.1.4-next.2) +13 more potentially affected by CVE-2024-30253 via @solana/web3.js (1.50.1)

@solana/web3.js NPM version 1.50.1 is affected by a known vulnerability. The following packages have a transitive dependency on @solana/web3.js and may be impacted: - @chainify/solana =1.2.14, =1.1.0-next.1, =1.28.2, =0.0.1-rc12, =3.0.0-alpha.16, =3.4.4, =2.0.0, =2.0.0, =0.3.12, =0.3.3, =0.3.3,...

@axyzsdk/js (0.0.0), @axyzsdk/react (0.0.0) +4 more potentially affected by CVE-2024-30253 via @solana/web3.js (>=1.35.0, <=1.35.1)

@solana/web3.js NPM version =1.35.0, =3.0.7, =1.0.0-alpha.1, =0.0.1-rc.1, =0.0.1-rc.3, =0.0.2-rc.3 Source cves: CVE-2024-30253 Source advisory: OSV:GHSA-8M45-2RJM-J347...

soltokenbalance (>=1.0.0, <=1.0.1) potentially affected by CVE-2024-30253 via @solana/web3.js (1.20.0)

@solana/web3.js NPM version 1.20.0 is affected by a known vulnerability. The following packages have a transitive dependency on @solana/web3.js and may be impacted: - soltokenbalance =1.0.0, =1.0.1 Source cves: CVE-2024-30253 Source advisory: OSV:GHSA-8M45-2RJM-J347...

@audius/sdk (>=0.0.3-beta.1, <=3.0.8-beta.12), @audius/stems (>=1.5.2-beta.1, <=1.5.4) +14 more potentially affected by CVE-2024-30253 via @solana/web3.js (>=1.37.0, <=1.37.2)

@solana/web3.js NPM version =1.37.0, =0.0.3-beta.1, =1.5.2-beta.1, =0.0.3, =0.0.1, =0.2.0, =1.5.1, =0.3.3, =3.2.8, =3.3.0 - @winter-love/wallet 1.0.25-alpha.14 - kyzr-marketplace-sdk 0.0.1 and more Source cves: CVE-2024-30253 Source advisory: OSV:GHSA-8M45-2RJM-J347...

@debridge-finance/solana-grpc (>=1.1.2, <=1.1.3), @mochi-web3/connect-wallet-widget (>=0.0.7, <=0.2.10) +2 more potentially affected by CVE-2024-30253 via @solana/web3.js (1.74.0)

@solana/web3.js NPM version 1.74.0 is affected by a known vulnerability. The following packages have a transitive dependency on @solana/web3.js and may be impacted: - @debridge-finance/solana-grpc =1.1.2, =0.0.7, =0.2.2, =1.194.0, =1.261.0 Source cves: CVE-2024-30253 Source advisory:...

@aurora-is-near/intents-swap-widget (>=3.17.2, <=7.25.1), @aurora-is-near/intents-swap-widget-standalone (>=6.0.0, <=7.25.1) +16 more potentially affected by CVE-2024-30253 via @solana/web3.js (1.68.0)

@solana/web3.js NPM version 1.68.0 is affected by a known vulnerability. The following packages have a transitive dependency on @solana/web3.js and may be impacted: - @aurora-is-near/intents-swap-widget =3.17.2, =6.0.0, =0.17.1, =1.0.33, =2.18.0, =0.2.3, =0.9.0, =0.9.0, =0.21.4-beta, =0.72.0,...