SOMEONE'S POKING THE BEAR WITH INFOSTEALERS TARGETING RUSSIAN CRYPTO DEVELOPERS

Summary from the TLDR InfoSec newsletter

Security researchers found malicious npm packages "solana-pump-test" and "solana-spl-sdk" posing as Solana SDK components but stealing cryptocurrency data from Russian developers. These infostealers send data to US servers, suggesting possible state-sponsored activity targeting Russia's ransomware ecosystem relying on cryptocurrency. The attacker, using the handle "cryptohan," promotes these packages that expose password files, exchange credentials, and wallet data from infected systems.