SOLANA WEB3.JS LIBRARY BACKDOORED TO STEAL PRIVATE KEYS

Summary from the TLDR InfoSec newsletter

The Solana web3.js SDK was backdoored by a malicious commit for roughly 5 hours on December 2. The backdoor was hidden in a new addToQueue function which sent the user's private key in seemingly benign headers to an attacker-controlled server. Calls to the function were then placed in strategic locations in the key generation and loading process. The developers urge any developers who think they might have been compromised to rotate their keys.