CVE-2024-54134: Solana web3.js Information Disclosure Flaw

CVE-2024-54134 Overview

CVE-2024-54134 documents a supply chain compromise of @solana/web3.js, a JavaScript client library widely used by Solana decentralized applications. An attacker gained publish access to the package and released two malicious versions, 1.95.6 and 1.95.7, between 3:20 PM and 8:25 PM UTC on December 3, 2024. The modified code exfiltrated private key material from any application that imported the package and directly handled keypairs. Bots, backend services, and other custodial systems faced the highest exposure. Non-custodial wallets are not affected because they do not expose private keys during transaction signing. Maintainers unpublished the malicious versions within hours and released a clean 1.95.8 build.

Critical Impact
Attackers who pulled the trojanized package could steal Solana private keys and drain funds from any dapp, bot, or service that handled keypairs directly during the five-hour exposure window.

Affected Products

@solana/web3.js version 1.95.6
@solana/web3.js version 1.95.7
Solana dapps, trading bots, and backend services that imported either malicious version and processed private keys

Discovery Timeline

2024-12-03 - Malicious versions 1.95.6 and 1.95.7 published between 15:20 UTC and 20:25 UTC
2024-12-04 - CVE-2024-54134 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-54134

Vulnerability Analysis

The vulnerability is a software supply chain attack classified under [CWE-200] Exposure of Sensitive Information to an Unauthorized Actor. A publish-access account for the @solana/web3.js npm package was compromised. The attacker pushed two unauthorized releases that contained code designed to capture and exfiltrate private key material processed by the library. Any Solana application that ran npm install or npm update during the five-hour publication window pulled a backdoored dependency. Downstream services that handled keypairs directly, such as trading bots and custodial backends, exposed those keys to the attacker on first execution.

Root Cause

The root cause is not a flaw in the Solana protocol or in the legitimate library code. The maintainer account credentials for npm publishing were compromised, allowing an unauthorized actor to ship modified releases under a trusted package name. The npm registry honored the publish action because it originated from a valid maintainer identity.

Attack Vector

The attack vector is the npm dependency chain. A developer or build pipeline that resolved @solana/web3.js to version 1.95.6 or 1.95.7 automatically loaded the malicious code. When the application invoked library functions that touched private keys, the injected code captured the key material and forwarded it to attacker-controlled infrastructure. Stolen keys were then used to sign transactions and transfer assets out of the victim accounts. Refer to the GitHub Security Advisory GHSA-jcxm-7wvp-g6p5 for advisory details.

Detection Methods for CVE-2024-54134

Indicators of Compromise

Presence of @solana/web3.js version 1.95.6 or 1.95.7 in package-lock.json, yarn.lock, or installed node_modules
Install or update events for @solana/web3.js recorded between 15:20 UTC and 20:25 UTC on December 3, 2024
Outbound network connections from Node.js processes to unexpected hosts shortly after package installation
Unauthorized Solana transactions originating from server-held keypairs after that window

Detection Strategies

Run software composition analysis across CI pipelines and production hosts to flag the two malicious versions
Inspect build artifacts, container images, and serverless bundles for the affected versions, not just source repositories
Correlate npm install logs with process telemetry to identify which hosts executed the trojanized code
Review on-chain activity for any address whose private key was loaded by a Node.js process during the exposure window

Monitoring Recommendations

Alert on any new dependency version that lands in production without a corresponding pull request approval
Monitor outbound traffic from build agents and backend services for connections to non-allowlisted destinations
Track Solana transactions signed by server-held authority keys and flag unexpected transfer patterns
Enable npm audit signatures and provenance checks in CI to catch unsigned or unexpected publishes

How to Mitigate CVE-2024-54134

Immediate Actions Required

Upgrade @solana/web3.js to version 1.95.8 or later across every project, build pipeline, and deployed artifact
Rotate all keypairs that were loaded by an affected process, including multisig members, program upgrade authorities, and server signing keys
Sweep funds from any address whose key may have been exposed into freshly generated wallets
Audit transaction history for unauthorized transfers and document any losses for incident response

Patch Information

The maintainers unpublished versions 1.95.6 and 1.95.7 and released 1.95.8 with the malicious code removed. Solana developers should pin or upgrade to 1.95.8 or newer. Full details are available in the GitHub Security Advisory GHSA-jcxm-7wvp-g6p5.

Workarounds

Lock dependency versions to a known-good release such as 1.95.5 or 1.95.8 until upstream provenance is verified
Run signing operations inside hardware security modules or remote signers so private keys never reside in Node.js memory
Use ephemeral, scope-limited keys for automated services and rotate them on a fixed schedule

bash

# Configuration example
npm install @solana/web3.js@1.95.8
npm ls @solana/web3.js
npm audit --production