PhantomSync crypto wallet stealer: 17 npm packages targeting blockchain developers

July 15, 2026

A coordinated npm campaign published between July 13 and 15, 2026 distributed a crypto wallet stealer across 17 packages designed to look like everyday blockchain and DeFi development utilities. The packages carry names like base58-utils, abi-encode, eth-wallet-helpers, solana-key-utils, and chain-sdk-js, each of which reads as a plausible dependency for a developer building wallet tooling, a decentralized exchange, or a DeFi application.

Xygeni has published analysis attributing the campaign to PhantomSync, a cluster related to or copying the TeamPCP and Mini Shai-Hulud tooling family. All 17 packages are covered in Attestd's supply chain monitoring layer and return risk_state: critical with supply_chain.compromised: true for the affected versions.

One package, @sqlite-frame/nodesql, remains on npm at version 1.0.3 with no clean replacement available. That version is still flagged compromised. Any build environment that resolves to it via a default install is still exposed.

The import-time detonation pattern#

This campaign does not use install hooks. The malicious code does not run at npm install time. It fires when the infected module is loaded by Node.js during normal application execution.

This is the same pattern documented in the AsyncAPI re-compromise post from yesterday. A build that runs npm install with --ignore-scripts still gets the package. A pipeline that sandboxes the install step still runs the payload the moment the application imports the module. The exposure window is wider than a preinstall hook because it is harder to contain.

What Attestd returns#

curl "https://api.attestd.io/v1/check?product=%40amedit%2Fvercel-builder-probe&version=1.0.3" \
  -H "Authorization: Bearer $ATTESTD_API_KEY"

{
  "product": "@amedit/vercel-builder-probe",
  "version": "1.0.3",
  "supported": true,
  "risk_state": "critical",
  "risk_factors": ["supply_chain_compromised"],
  "confidence": 0.95,
  "cve_ids": [],
  "supply_chain": {
    "compromised": true,
    "sources": ["osv"],
    "malware_type": "malware",
    "description": "Malicious code in @amedit/vercel-builder-probe (npm)",
    "compromised_at": "2026-07-14T03:24:31Z"
  },
  "supply_chain_monitored": true
}

No CVEs. No vulnerability record. risk_state: critical from the supply chain signal alone. The pattern holds across all 17 packages in the cluster.

The clean replacement for @amedit/vercel-builder-probe is 0.0.1-security, the registry's standard placeholder for deprecated packages, which returns risk_state: none with supply_chain.compromised: false.

The still-live package#

@sqlite-frame/nodesql at version 1.0.3 is both the npm latest tag and flagged compromised. There is no clean version to upgrade to.

{
  "product": "@sqlite-frame/nodesql",
  "version": "1.0.3",
  "risk_state": "critical",
  "supply_chain": {
    "compromised": true,
    "sources": ["osv"],
    "compromised_at": "2026-07-15T01:12:34Z"
  }
}

Any project with @sqlite-frame/nodesql in its dependency tree should remove it entirely. There is no safe version to pin to.

The full cluster#

All 17 packages return risk_state: critical for the compromised versions listed. chalk-plus-ts is included in the cluster by version stamp correlation but carries a June 12 compromised_at timestamp, predating the July campaign window. It is flagged compromised but may represent a separate or earlier activity.

A note on @web3-helpers/core#

This package returns a typosquat signal alongside the supply chain flag:

"typosquat": {
  "detected": true,
  "kind": "hallucination",
  "resembles": "web3-helpers",
  "likely_intended": ["web3-helpers", "web3-helper"],
  "confidence": 0.9,
  "ecosystem": "pypi"
}

The typosquat signal here is a cross-ecosystem hallucination flag. The npm scoped package @web3-helpers/core resembles PyPI package names that AI coding assistants commonly hallucinate. The supply chain compromise is the primary signal. The typosquat detection is secondary context, noting that the package name itself sits in a hallucination-prone namespace that could draw installs from misdirected agent-driven dependency resolution.

Attribution#

Xygeni published the primary analysis of this campaign on July 14, 2026. Their writeup covers the original eight-package cluster, the PhantomSync naming, the idle-gated activation mechanism, the base64-encoded test fixture dropper, and the IPFS exfiltration infrastructure in technical detail. The attribution to PhantomSync as a TeamPCP or Mini Shai-Hulud related cluster originates from their research.

Full analysis: PhantomSync: npm Crypto Packages Hide Wallet Stealer — Xygeni, July 14, 2026.

Attestd's coverage extends the documented cluster to 17 packages based on version stamp and timing correlation in the supply chain monitoring pipeline. The additional nine packages are not in Xygeni's original report. Attribution on the extended cluster is inferred from shared tooling and timing patterns, not independently confirmed.

Coverage#

All 17 packages are covered and returning accurate signals as of July 15, 2026. The single package with no clean replacement, @sqlite-frame/nodesql, is flagged in the API response. Projects that depend on any package in this cluster should audit their lockfiles and remove affected versions. Any build environment that loaded these modules during the compromise window should be treated as potentially exposed and secrets rotated.

API documentation: attestd.io/docs. Detection ledger: github.com/attestd-io/detection-ledger. Machine speed thesis: attestd.io/thesis