According to PANews, a security incident involving a GitHub-hosted open-source project has resulted in the theft of cryptocurrency assets. On July 2, a victim reported using the project named zldp2002/solana-pumpfun-bot, which led to the unauthorized access and theft of their digital assets. The SlowMist security team analyzed the attack, revealing that the perpetrators disguised the malicious code as a legitimate open-source project. This deception encouraged users to download and execute the harmful Node.js project, which contained malicious dependencies. As a result, users' wallet private keys were compromised, leading to asset theft.
The attack involved multiple GitHub accounts working in coordination, which expanded the reach and credibility of the malicious project, making it highly deceptive. This type of attack combines social engineering with technical methods, making it challenging to defend against even within organizations.
SlowMist advises developers and users to exercise extreme caution when dealing with unfamiliar GitHub projects, especially those involving wallet or private key operations. It is recommended to run and debug such projects in isolated environments without sensitive data to mitigate risks.
