Aave

SwissBorg

Major

Morpho

Security

<p>Ledger’s Chief Technology Officer, Charles Guillemet, issued a strong warning on Monday, urging some users to temporarily stop on-chain transactions. The alert comes after a massive supply chain attack compromised a trusted developer’s NPM account, affecting packages that have been downloaded over 1 billion times.</p>
<p>“There’s a large-scale supply chain attack in progress,” Guillemet said in a post on X. “If you use a hardware wallet, pay attention to every transaction before signing and you’re safe. If you don’t, refrain from making any on-chain transactions for now.”</p>
<div class="embedpress-gutenberg-wrapper aligncenter   ep-content-protection-disabled inline" id="353dd1c7-08ac-408b-9f96-1ab97c6ab344">
 <div class="wp-block-embed__wrapper   ">
  <div id="ep-gutenberg-content-9060dbe2b54741c642f45a12dec5114f" class="ep-gutenberg-content">
   <div>
    <div class="ep-embed-content-wraper  insta-grid  ">
     <div class="ose-twitter ose-uid-9fddc74313363e7e3864f3f7bbe7833e ose-embedpress-responsive" style="width: 100%; height:600px; max-height:600px; max-width:100%; display:inline-block;">
      <blockquote class="twitter-tweet">
       <p>🚨 There’s a large-scale supply chain attack in progress: the NPM account of a reputable developer has been compromised. The affected packages have already been downloaded over 1 billion times, meaning the entire JavaScript ecosystem may be at risk.<br><br>The malicious payload works…</p>— Charles Guillemet (@P3b7_) <a href="https://twitter.com/P3b7_/status/1965094840959410230?ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">September 8, 2025</a>
      </blockquote>
     </div>
    </div>
   </div>
  </div>
 </div>
</div>
<h2 class="wp-block-heading" id="how-the-attack-works">How the Attack Works</h2>
<p>Supply chain attacks target the software distribution process, not individual users. Here, hackers acquired the NPM account of a developer ‘qix’.</p>
<p>They allegedly inserted malicious code, which replaces cryptocurrency addresses automatically, deceiving users to send money to the attacker, rather than the receiver. This method is similar to tactics used by North Korean hackers to <a href="https://www.cryptotimes.io/2025/02/27/north-korea-responsible-behind-1-5-billion-bybit-hack-fbi/" target="_blank" rel="noopener noreferrer nofollow">steal $1.5 billion</a> from the crypto exchange Bybit earlier this year.</p>
<p>Crypto developers quickly noticed the attack. @0x_ultra <a href="https://x.com/0x_ultra/status/1965105221321068572" target="_blank" rel="noopener noreferrer nofollow">shared</a> that packages like Chalk, with over 2 billion weekly downloads, were compromised and could steal private keys.</p>
<p>The impacted developer verified the attack, saying that phishing emails that pretended to be NPM threatened to lock accounts of maintainers to tempt them to visit rogue websites. However, at the time of reporting, the attacker only managed to steal $498.</p>
<h2 class="wp-block-heading" id="what-users-should-do">What Users Should Do</h2>
<p>The compromised packages were reportedly patched around 15:15 UTC. However, websites and apps that updated dependencies recently might still be at risk.&nbsp;</p>
<p>Further, Uniswap, Metamask, Ledger, OKX Wallet, Sui, Aave and Morpho have stated that they were “not affected” by the NPM supply chain attack.</p>
<p>Guillemet also reassured users that those using hardware wallets with clear signing are safe. Developers are encouraged to verify all the dependencies and make sure that they are not using the compromised versions.</p>
<p>This attack is being described as possibly the biggest supply chain attack in history, and it is a reminder of the increasing risks in the software ecosystem and the role of security in crypto transactions.</p>
<blockquote class="wp-block-quote is-layout-flow wp-block-quote-is-layout-flow">
 <p>Also Read: <a href="https://www.cryptotimes.io/2025/09/09/swissborg-crypto-platform-loses-41m-solana-in-major-security-breach/" target="_blank" rel="noopener noreferrer nofollow">SwissBorg Crypto Platform Loses $41M Solana in Major Security Breach</a></p>
</blockquote>

Ledger CTO Warns Users Amid Massive NPM Supply Chain Attack

Table of Contents

The Crypto Times

Other articles published on Sep 9, 2025

FLOKI Breaks Out of Bullish Wedge — What’s Next for This Meme Coin Rally?

Ethena USDe (USDE) Hits Binance: Why Traders Are Watching This Listing Closely

XRP Price Prediction for Today, September 9

Shiba Inu Slides Hard, AAVE Stalls Below $318, BlockDAG Grabs Attention With $0.0013 Entry and Up...

US Congress seeks report ironing out details of Bitcoin reserve

“We Are Bullish Hyperliquid,” VanEck CEO Says As HYPE Price Hits New ATH

Join our free newsletter for daily crypto updates!