A second wave of the malicious PyPI package solana-token arrived on May 4, 2025, with version 0.0.2 carrying a quietly refined variant of the source code exfiltration payload first seen in v0.0.1. Armando identified that this update changes a single line in the attack logic -- the filter that decides which Python files to steal -- making the stealer more precise in what it sends to the attacker-controlled server at 84.54.44.100:3000. The package has been removed from PyPI and had accumulated 859 downloads across all versions.
%22%3E%0A%20%20%20%20%20%20%3Crect%20width%3D%2210%22%20height%3D%2220%22%20fill%3D%22%23f2930d%22%2F%3E%0A%20%20%20%20%20%20%3Crect%20x%3D%2210%22%20width%3D%2210%22%20height%3D%2220%22%20fill%3D%22%230d0d0d%22%2F%3E%0A%20%20%20%20%3C%2Fpattern%3E%0A%20%20%3C%2Fdefs%3E%0A%20%20%3Crect%20width%3D%221200%22%20height%3D%226%22%20fill%3D%22url(%23caution-stripe)%22%2F%3E%0A%3C%2Fsvg%3E){kind=small}
solana_token loses its source code to the attackerThe solana-token package on PyPI presents itself as a utility for the Solana blockchain ecosystem. Its description -- "Solana token package" -- targets developers building on or integrating with the Solana network, a high-value segment of the crypto developer community. The package has no declared source code repository, no homepage, and no verifiable maintainer identity, all of which are red flags for a package of this kind.
The name solana-token first appeared on PyPI on April 2, 2024, with versions 1.0.1 and 1.0.2. A second publishing cluster -- versions 0.0.1 and 0.0.2 -- appeared over a year later on May 4, 2025. Every version in the catalog is flagged as malicious by Spectra Intelligence, indicating no legitimate history exists for this package. Armando found that the same payload structure was also deployed in the sibling package solana-test (also fully removed), showing that the attacker was running a parallel package campaign under the Solana brand.
The attack is built around a single malicious Python module, prices.py, which is included in both the wheel distribution (solana_token-0.0.2-py3-none-any.whl) and the sdist (solana_token-0.0.2.tar.gz). The module exposes a collection of functions that look like a blockchain API wrapper -- methods named get_balance, submit_transaction, mine_new_block, and over twenty others that call what appears to be a configurable node endpoint.
The payload is hidden inside register_node(), one of the exported functions. When called, that function uses Python's inspect.stack() to walk the current call stack, finds the first Python file in the stack that is not the package itself or the Python importlib machinery, opens that file for reading, and sends its full source code to http://84.54.44.100:3000/nodes/register as a POST request with a JSON body.
The trigger is at the very bottom of the file: a bare top-level call register_node("http://base_url", "node_url:9273") executes when the module is first imported. Any developer who runs from solana_token import prices or import solana_token causes their own source file to be read and posted to the attacker's server immediately, without any further user interaction.
The change from v0.0.1 to v0.0.2 is subtle and telling. In v0.0.1 the stack-walk filter excluded files named markets.py -- a name that suggests the package was initially crafted to target trading or market automation scripts. In v0.0.2 that filter is replaced with one that excludes prices.py itself. This is a self-exclusion refinement: the attacker realized that the module could end up exfiltrating its own source, and corrected the filter to skip it. The C2 endpoint and the exfiltration mechanism are otherwise identical between the two versions. Armando's analysis confirms that three files were changed between v0.0.1 and v0.0.2 -- prices.py, the wheel, and the metadata -- with no files added or removed.
The attacker's infrastructure uses a bare IP address (84.54.44.100) on a non-standard port (3000), consistent with a lightweight HTTP server rather than a production service with a domain name. The use of standard library calls only (urllib.request, inspect, json, os) means the payload has no external dependencies and cannot be detected by scanning for suspicious third-party imports.
prices.py is the core malicious module. As Armando's analysis shows, register_node() uses inspect.stack() to read the caller's .py file and POST its content to http://84.54.44.100:3000/nodes/register. In v0.0.2, the stack-walk filter changes from excluding markets.py to excluding prices.py itself -- a self-exclusion refinement that makes the stealer more reliable. The function is called unconditionally at module top-level, triggering exfiltration on every import. Detected as Script-Python.Infostealer.SupplyChain.
solana_token-0.0.2-py3-none-any.whl is the wheel archive containing the malicious prices.py. It is the primary distribution artifact installed by pip install solana-token. Detected as Archive-ZIP.Infostealer.SupplyChain.
PKG-INFO carries package metadata that shares the same malicious file reputation as the rest of the distribution, flagged as Text.Infostealer.SupplyChain.
Developers and security teams should take the following steps:
solana-token v0.0.2 (or v0.0.1) appears in your dependency tree, including transitive dependencies. Any pipeline that ran pip install while this version was current should be considered potentially affected. Note that both 0.0.1 and 0.0.2 are malicious.solana-token exists -- all four published versions are malicious. Do not replace with another version from this package.solana_token was exfiltrated to 84.54.44.100:3000. Review what code was in scope and treat it as potentially exposed to the attacker.| Filename | SHA256 | Detection |
|---|---|---|
| prices.py | 634022eb88a21fb870080055be00c431608132c61428df0836bc8583e71222f2 | Script-Python.Infostealer.SupplyChain |
| PKG-INFO | 4c0981df63c8f30fc292ad67413d8d92613daf08567198876f976c2353bc71ec | Text.Infostealer.SupplyChain |
| pyproject.toml | 4f0414d99253d797f7054d76ea6423eea982978ce222b8efd820335e1ac5e06a | Text.Infostealer.SupplyChain |
| URL / IP | Purpose |
|---|---|
| http://84.54.44.100:3000/nodes/register | Source code exfiltration endpoint; receives POST with stolen Python file contents |
| File | SHA256 |
|---|---|
| solana_token-0.0.2-py3-none-any.whl | 022ad1f50e147ad52cbe3641d3f917d3092f5968eecbd7c2c8ff8a3a8d611ef3 |
| solana_token-0.0.2.tar.gz | cc3ffa4ba949b352afe15ddf27ba5328322a7a29c1a84a14c7ad6cf2fc684cf3 |