pumpdotfun-sdk-v3.0@3.1.3
Malicious code in pumpdotfun-sdk-v3.0 (npm)
Analysis
A Solana private-key drainer disguised as a pump[.]fun SDK. The verifyParams() function in pumpfun.mjs takes a Solana Keypair, bs58-encodes the full secretKey (the wallet's private key), and silently sends it via an HTTP GET fetch to hxxps://verify.pumpsol[.]net/?pk=<exfiltrated-key>. The call is triggered during createAndBuy() and getCreateInstructions(), so any developer using this SDK to create a token on pump[.]fun has their Solana wallet drained. The domain pumpsol[.]net typosquats pump[.]fun, and all errors are silently caught via .catch(()=>{}) so the developer never sees the exfiltration.
- analyzed by
- Leitwacht
- first seen
- Jun 12, 2026, 04:53 PM
- analyzed
- Jun 12, 2026, 04:56 PM
Related advisories
- program-commander@14.1.9
- polymarket-trading-cli@0.1.0
- polymarket-trader@0.1.0
- polymarket-terminal@0.1.0
- polymarket-onchain-plugin@2.1.3
- pino-pretty-logger@1.1.1
- period-newline@0.1.0
- index-ulid@3.0.2
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.