{"id":161779,"date":"2025-07-04T09:00:23","date_gmt":"2025-07-04T06:00:23","guid":{"rendered":"https:\/\/cryptodnes.bg\/en\/?p=161779"},"modified":"2025-07-04T00:07:20","modified_gmt":"2025-07-03T21:07:20","slug":"solana-pumpfun-bot-turns-out-to-be-malware-in-disguise","status":"publish","type":"post","link":"https:\/\/cryptodnes.bg\/en\/solana-pumpfun-bot-turns-out-to-be-malware-in-disguise\/","title":{"rendered":"Solana PumpFun Bot Turns Out to Be Malware in Disguise"},"content":{"rendered":"
The project, called \u201csolana-pumpfun-bot\u201d, was published under the GitHub user zldp2002 and quickly gained traction in the community. But instead of offering real functionality, the bot silently stole cryptocurrencies from users\u2019 wallets and funneled the funds to a platform called FixedFloat.<\/p>\n
SlowMist\u2019s investigation revealed that the bot was built with Node.js and used a shady dependency named \u201ccrypto-layout-utils\u201d, which isn\u2019t listed in official NPM repositories. Once installed, this package silently scanned for private keys and wallet files on the user\u2019s device and sent them to an attacker-controlled server, githubshadow.xyz.<\/p>\n
The malware\u2019s code was heavily obfuscated, making it difficult to detect. The attacker also forked the project multiple times using fake GitHub accounts, amplifying exposure. Some of these forks used an alternate malicious package, \u201cbs58-encrypt-utils-1.0.3\u201d.<\/p>\n
The attack appears to have been active since June 12, 2025, and was only discovered after a victim contacted SlowMist a day after installing the project. Post-exploit on-chain analysis using SlowMist\u2019s MistTrack tool confirmed the stolen funds were routed to FixedFloat.<\/p>\n