@solana/web3.js stole private keys

Catalogued from the tstromberg supplychain-attack-data dataset
(community-curated incident corpus). Included because first-party
sources exist for it; see the links below — vendor advisories, project
incident reports, and researcher write-ups. Not based on aggregator
coverage.

Mapped techniques

T0172 Runtime backdoor
T0184 Harvesting sensitive information from files

supply-chain campaign

T0172 · Execution · Runtime backdoor

Backdoor/RAT payload documented by the cited sources.

T0184 · Credential Access · Harvesting sensitive information from files

Credential or wallet material targeted.

T0184 · Credential Access · Harvesting sensitive information from files

Wallet/keys targeted.

Sources

https://nvd.nist.gov/vuln/detail/CVE-2024-54134
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-54134
https://www.cyfrin.io/blog/critical-security-alert-solana-web3-js-library-compromise
https://github.com/solana-labs/solana-web3.js/releases/tag/v1.95.8
https://www.theregister.com/security/2024/12/05/solana-javascript-sdk-backdoored-to-steal-keys-funds/1065507
https://github.com/advisories/GHSA-jcxm-7wvp-g6p5