{
  "title": "Crypto Private Key Stealer Solana/Ethereum Typosquats",
  "summary": "Socket disclosed five npm typosquats targeting Solana and Ethereum developers on 2026-03-24. Registry metadata shows malicious releases dating from 2025-11-18 through 2026-02-16; npm replaced four package records with security placeholders on 2026-04-01.",
  "date": "2026-03-24",
  "severity": "critical",
  "tags": [
    "npm",
    "malicious-package",
    "typosquatting",
    "credential-theft",
    "crypto-stealer"
  ],
  "sources_count": 9,
  "indicators": {
    "slug": "crypto-key-stealer-typosquats",
    "since": "2026-03-24T00:00:00Z",
    "until": "unknown",
    "ecosystem": "",
    "cves": [],
    "cwes": [],
    "advisoryIds": [],
    "products": [],
    "packages": [],
    "versions": [],
    "affectedVersions": [],
    "fixedVersions": [],
    "files": [],
    "paths": [],
    "services": [],
    "domains": [
      "api.telegram.org"
    ],
    "urls": [
      "https://api.telegram.org/bot7231970337:AAExyV3dvbNs6xkMJB7S2hArUash9owd-bw/sendMessage`"
    ],
    "ips": [],
    "hashes": [
      "d747b41739349828566bfae0b522ef4b746a6f46e828a395d1f3922b66442d40"
    ],
    "processPatterns": [],
    "networkPatterns": [],
    "telemetrySelectors": []
  }
}