Compromised Solana web3.js npm releases expose downstream applications to malicious code

On 03/12/2024, a publish-access account for the legitimate @solana/web3.js package was compromised, allowing unauthorized versions 1.95.6 and 1.95.7 to be published to npm with code capable of stealing private-key material from applications that directly handled keys. The malicious distribution window lasted roughly five hours before patched version 1.95.8 replaced the affected releases.