Malicious ‘SKR Claim’ App Briefly Listed on Solana DApp Store

The incident shifts attention from smart-contract risk to the publishing layer itself: an attacker who can alter storefront interfaces can surface a drainer without touching any on-chain protocol, and an hour of exposure is enough for seed phrases to be harvested. It matters most for Solana Mobile's device and DApp Store ecosystem, whose credibility rests on curation as a differentiator from open app stores. The patched link vulnerability and the removal from installed devices address the immediate vector, but whether storefront review and publishing access controls hold up under further probing is the open question.