Yu Xian: A certain open source bot has a backdoor code that steals private keys, users need to be vigilant

Security researcher dm posted on the X platform: "Be careful when downloading and running Web3 projects on Github. Today, I occasionally saw an open source project that was found to steal the user's Solana private key. Checkrug.py uses base64/zlib loop encoding and then secretly executes: hxxps://github.com/HELIPOX/solana-sniper-bot." In response, SlowMist founder Yu Xian posted a comment on the X platform: "This open source bot has a backdoor code for stealing private keys. If you are not familiar with the code, you need to be vigilant when you see fancy codes ("garbled code"), which may be secretly hiding something. Crypto is all about open source. If it is open source, it is eager to provide highly readable code. Who would want to use these fancy codes? In addition, the author seems to have deleted the backdoor file. Players who have downloaded and used this bot can contact us."