SolHODL

The ultimate Solana NFT holder verification protocol. Securely authenticate NFT ownership, manage roles, and create exclusive experiences for your community.

[CryptoFlan.dev @cryptoflan]

Solana will be much safer soon with the help of SolHODL!

[SolHODL @SolHODL_]

Our Solana Holder Verification is underway, with our team diligently testing it. We've added features every collection needs, including automated VPN/alt detection at the holder verification level.

Security is crucial to us and should be for your community too!

No more spam, alts, bots, or people bypassing server bans. Our state-of-the-art feature detects 99% of global VPNs, both commercial and datacenter-level. We built a robust alt detection feature that shares data with other SolHODL Discord servers to prevent bad actors from using alts to gain holder benefits, ensuring fairness. Token and NFT communities will benefit greatly.

Your community will know security, safety, and fairness are priorities with SolHODL. This is one of many features we've implemented to manage your Solana community, with too many to list.

As we alpha test with our team and community, we'll keep you updated on new features and planned release info.

Soon, we expect SolHODL to be the most advanced and feature-rich Solana Holder Verification used by all Solana communities!

[SolHODL @SolHODL_]

Stay safe out there everyone!

[CryptoFlan.dev @cryptoflan]

🚨 BREAKING: Massive NPM Supply Chain Attack Targets Crypto Wallets! 🚨

If you're a dev or crypto user relying on Node.js packages, this is a wake-up call. Attackers hacked maintainer Sindre Sorhus's NPM account, injecting malware into 18 popular packages like chalk and debug ,these get over 2B downloads/week combined!

I've researched this deep as a web/app security analyst. Let's break it down in this thread: how it works, what's affected, and a solid step-by-step to protect yourself.

How it works: Malware sneaks in via new versions of these packages. Once installed (e.g., via npm install), it runs stealthy:

- Monitors your clipboard for crypto addresses, swaps them with attacker ones using homoglyphs (look-alike chars, e.g., l vs I).

- Hooks into web3 APIs in browsers, altering tx recipients before you confirm.

This hits during copy-paste or wallet interactions. Similar to past attacks on Nx/React in July-Aug 2025 that stole creds, or April's fake PDF converters tampering Atomic/Exodus on Windows.

It's part of a wave, August's nodejs-smtp fake mimicked Nodemailer to redirect BTC/ETH/USDT/XRP/SOL funds.
Affected Packages (100% confirmed malicious versions):

- [email protected]
- [email protected]
- [email protected]
- [email protected]
- [email protected]
- [email protected]
- [email protected]
- [email protected]
- [email protected]
- [email protected]
- [email protected]
- [email protected]
- [email protected]
- [email protected]
- [email protected]
- [email protected]
- [email protected]
- [email protected]

If your project deps include these versions, you're at risk. Check package.json/lockfile NOW.

Affected Chains: Malware targets addresses from:

- Bitcoin (BTC)
- Ethereum (ETH)
- Solana (SOL)
- Tron (TRX)
- Litecoin (LTC)
- Bitcoin Cash (BCH)

It doesn't hit every chain, but these are confirmed. If you're on these, extra vigilance.

Affected Wallets:

- Browser extensions: MetaMask, Phantom, malware intercepts web3 calls, changes recipients pre-confirmation.

- Desktop apps: Atomic Wallet, Exodus – can tamper files, persist post-removal (seen in similar attacks).

Hardware wallets like Ledger and Trezor are SAFE! They display tx details on-device for verification, malware can't alter that. Always use hardware for big txs.

Not affected: Mobile-only wallets without desktop/browser ties, but if your dev machine is infected, indirect risks.

Step-by-Step to Stay Safe (Dev-Focused, but Applies to Users):

1. Audit your project: Open package.json and yarn.lock/package-lock.json. Search for the listed malicious versions. If found, act fast.

2. Pin safe versions: In package.json, add "overrides" (NPM) or "resolutions" (Yarn) to force prior safe releases, e.g.:

"overrides": {
"chalk": "5.3.0" // or last good version
}

Research exact safe versions per package on https://t.co/UH2xeOWPU7.

3. Nuke & Rebuild: Delete node_modules folder and lockfile. Run npm install (or yarn) to pull safe deps.

4. Scan for vulns: Use 'npm audit' or tools like Snyk before any installs. Enable 2FA on your NPM account.

More Safety Steps:

5. For wallets: Disable browser extensions like MetaMask/Phantom temporarily if dev-infected. Reinstall desktop wallets (Atomic/Exodus) from official sites ONLY, verify hashes/wallets/addresses!.

6. Best practices: NEVER copy-paste addresses, type manually or use QR. Verify EVERY char on hardware wallet screen before signing.

7. Monitor: Check wallet activity for unauthorized txs. If suspect, rotate keys/seeds immediately.

8. Pause on-chain: No txs until all-clear from maintainers/security firms like Chainalysis.

Bonus: Use virtual machines for dev to isolate risks.

This is why supply chain security matters in crypto/dev world. I've seen too many rugs/hacks, stay vigilant!

If you're hit or have questions, drop below. Sources: Check @P3b7_ original post and npm advisories.

https://t.co/f13qvNmyxt

Stay safe out there!