In May 2025, cybersecurity researchers identified a malicious Python package named ‘solana-token’ on the Python Package Index (PyPI). This package was designed to steal source code and sensitive information from developers working on Solana blockchain applications. Disguised as a legitimate utility for Solana-based projects, ‘solana-token’ contained code that exfiltrated critical data to a remote server.
The threat was discovered by ReversingLabs researchers, who noted its rapid dissemination; the package was downloaded over 600 times before its removal. The malware specifically targeted developers by exploiting trust in open-source repositories. Its attack vector relied on social engineering, leveraging the popularity of the Solana ecosystem to lure victims.
Once installed, the package executed a script that scanned the system for Python files, extracted their contents, and sent the stolen data to a hard-coded IP address (84.54.44.100:3000). This server, likely controlled by threat actors, could enable further attacks, including credential theft or infrastructure compromise.
ReversingLabs analysts highlighted the package’s unique focus on source code exfiltration—a tactic less common in typical infostealer campaigns. By harvesting developers’ unprotected secrets (e.g., API keys, wallet credentials), attackers could gain a foothold in cryptocurrency projects, posing risks to both individual developers and decentralized platforms.
The campaign aligns with a broader trend: 23 malicious crypto-focused supply chain attacks were documented in 2024 alone, according to ReversingLabs’ 2025 Software Supply Chain Security Report.
Infection Mechanism and Code Analysis
The malware’s payload was embedded within a function named `register_node`. When invoked, this function iterated through the Python execution stack, identifying `.py` files unrelated to specific libraries (`prices.py`, `importlib`). It then read each file’s content and transmitted it via HTTP POST requests to the attacker’s server.
This approach ensured broad capture of project files, including those containing hardcoded credentials. Notably, the attackers reused the ‘solana-token’ name from a 2024 PyPI package removed for similar activity. PyPI’s policies allow republishing if authors—not administrators—remove a package, creating opportunities for name-squatting.
ReversingLabs reported the package to PyPI, prompting its removal. However, the incident highlights systemic vulnerabilities in open-source ecosystems. Developers are urged to audit dependencies, monitor for suspicious network activity, and adopt tools like static code analysis to detect obfuscated threats. As supply chain attacks evolve, proactive defense remains critical to safeguarding sensitive code and infrastructure.
Indicators of Compromise (IOCs)
– Package: `solana-token` (v0.0.1, v0.0.2)
– SHA1 Hashes: `f4e1149360174b4fcf0dcc6e61898c81803`, `e07457e36bf9aab1dc2b54acd30ec8f9e5c`
– C2 Server: `84.54.44.100:3000`
