This allowed an attacker to publish unauthorized and malicious packages that were modified, allowing them to steal private key material and drain funds from dapps, like bots, that handle private keys directly.
Anza went on to urge all Solana app developers to upgrade to version 1.95.8, which at the time this post went live on Ars, was the latest available.
The backdoor came in the form of code that collected private keys and wallet addresses when apps that directly handled private keys incorporated solana-web3.js versions 1.95.6 and 1.95.7.
This issue should not affect non-custodial wallets, as they generally do not expose private keys during transactions.
Collection
[
|
...
]