Nothing

random

Morpho

Venus

<p>This week, the open source world came face-to-face with what could have been a nightmare. A developer’s Node Package Manager (NPM) account, the very platform where countless JavaScript libraries live, was hijacked. Malicious updates quietly slipped into some of the most widely used packages, which together account for more than a billion downloads every week.</p>
<p>Had the attack gone unnoticed a little longer, the fallout could have been enormous. Almost every major project in the JavaScript ecosystem, from small web apps to large crypto platforms, might have been exposed.</p>
<div class="embedpress-gutenberg-wrapper aligncenter   ep-content-protection-disabled inline" id="913b6e2f-7004-4219-bd11-b8aec481a563">
 <div class="wp-block-embed__wrapper   ">
  <div id="ep-gutenberg-content-65164af138e0217ecac1dbf4368be5dd" class="ep-gutenberg-content">
   <div>
    <div class="ep-embed-content-wraper  insta-grid  ">
     <div class="ose-twitter ose-uid-9fddc74313363e7e3864f3f7bbe7833e ose-embedpress-responsive" style="width: 100%; height:600px; max-height:600px; max-width:100%; display:inline-block;">
      <blockquote class="twitter-tweet">
       <p>🚨 There’s a large-scale supply chain attack in progress: the NPM account of a reputable developer has been compromised. The affected packages have already been downloaded over 1 billion times, meaning the entire JavaScript ecosystem may be at risk.<br><br>The malicious payload works…</p>— Charles Guillemet (@P3b7_) <a href="https://twitter.com/P3b7_/status/1965094840959410230?ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">September 8, 2025</a>
      </blockquote>
     </div>
    </div>
   </div>
  </div>
 </div>
</div>
<p>Ledger’s CTO Charles Guillemet put it bluntly: “There’s a large-scale supply chain attack in progress. If you use a hardware wallet, check every transaction carefully before signing. If you don’t, avoid on-chain transactions for now.”</p>
<p>The code was designed to steal crypto by swapping wallet addresses. Fortunately, it was discovered before it could spread widely, thanks to what was essentially a lucky break, a crash caused by outdated software.</p>
<h2 class="wp-block-heading" id="what-exactly-is-a-supply-chain-attack">What Exactly Is a Supply Chain Attack?</h2>
<p>Instead of hacking users one by one, attackers target the tools developers depend on. By compromising a library or build system, they can spread malware into thousands of apps downstream.</p>
<p>This time, the target was a well-known open source maintainer, known online as qix. He looks after packages like Chalk, Strip ANSI, and Color Convert. These are not glamorous tools, but deeply embedded utilities. They handle text, colors, and formatting in the background, meaning millions of projects pull them in automatically.</p>
<p>That’s what makes this incident so dangerous: the attack hit the roots of the ecosystem, not the leaves.</p>
<h2 class="wp-block-heading" id="how-it-began">How It Began</h2>
<p>The <a href="https://jdstaerk.substack.com/p/we-just-found-malicious-code-in-the" target="_blank" rel="noopener noreferrer nofollow">breach</a> started with an all too familiar trick: phishing. Attackers sent an email pretending to be from NPM support, warning the developer that his account would be suspended unless he verified details on a fake page. He did, and the attackers walked away with full access.</p>
<p>They quickly pushed tainted versions of several packages, including:</p>
<ul>
 <li>chalk (~300M weekly downloads)</li>
 <li>strip ansi (~261M)</li>
 <li>color convert (~193M)</li>
 <li>color name (~191M)</li>
 <li>error ex (~47M)</li>
 <li>simple swizzle (~26M)</li>
 <li>has ansi (~12M)</li>
</ul>
<p>Together, that’s billions of downloads each month. The attack surface was almost unimaginable.</p>
<h2 class="wp-block-heading" id="the-lucky-discovery">The Lucky Discovery</h2>
<p>Ironically, the attack didn’t unravel because of a security system. It fell apart because of an error message.&nbsp;</p>
<p>During a team’s automated build, a job crashed with the line:</p>
<p><strong>ReferenceError: fetch is not defined</strong></p>
<p>At first, it just looked like a small bug. Nothing serious. But then the app crashed, and when developers dug into the latest package update, they found obfuscated code hiding inside. The giveaway was a strange function named ‘<em>checkethereumw</em>.’ Tracing it showed the code trying to make fetch requests. Their Node.js was too old to run those calls, so the malware never went through.</p>
<p>On a newer setup, though, it could have slipped in quietly without warning. Something the code was really doing. Once decoded, the payload turned out to be a crypto clipper built to hijack transactions.&nbsp;</p>
<p>It worked in two ways:&nbsp;</p>
<ul>
 <li><strong>Address swapping:</strong> If no wallet extension was installed, the script scanned network traffic for crypto addresses. When it spotted one, it swapped it with a near-identical address from the attacker’s list. A similarity check made sure the fake looked close enough to fool the human eye.</li>
 <li><strong>Transaction hijacking:</strong> If a wallet like MetaMask was present, the malware tapped into its communication flow and tried to intercept transactions. Before a transaction was signed, it quietly swapped the recipient’s address. Unless the user carefully compared what was on screen, they could sign funds directly into the attacker’s pocket.</li>
</ul>
<p>The malware targeted multiple chains: Bitcoin, Ethereum, Solana, Tron, Litecoin, and Bitcoin Cash.</p>
<h2 class="wp-block-heading" id="tracing-the-attack">Tracing the Attack</h2>
<p>Because blockchains are public, researchers tracked one of the attacker’s Ethereum wallets:</p>
<p>0xFc4a4858bafef54D1b1d7697bfb5c52F4c166976</p>
<p>Surprisingly, the address had received only around $498. For an attack with such massive reach, that’s a tiny sum. Analysts believe coding mistakes, like the fetch crash, crippled the campaign before it could inflict real damage.</p>
<h2 class="wp-block-heading" id="industry-reactions">Industry Reactions</h2>
<p>Once word spread, the affected developer worked with NPM’s security team to remove the poisoned versions. Clean updates were quickly published.</p>
<p>Major crypto projects also rushed to reassure users:</p>
<ul>
 <li>Aave confirmed its app wasn’t affected.</li>
 <li>Uniswap said no vulnerable packages were in use.</li>
 <li>Teams at MetaMask, Ledger, OKX Wallet, Sui, and Morpho all confirmed they were safe.</li>
</ul>
<p>These rapid statements helped calm fears before rumors spiraled out of control.</p>
<h2 class="wp-block-heading" id="why-hardware-wallets-still-matter">Why Hardware Wallets Still Matter</h2>
<p>The incident reinforced a point security experts repeat often: hardware wallets aren’t just for “paranoid” users. They are the last line of defense.</p>
<p>Unlike browser wallets or mobile apps, hardware wallets show transaction details directly on the device. Features like Clear Signing make sure the real recipient address is displayed before approval. Even if malware tampers with a browser or app, the hardware device forces users to double-check.</p>
<div class="embedpress-gutenberg-wrapper aligncenter   ep-content-protection-disabled inline" id="4469fb79-131a-45bf-8a2e-844d2e97adc2">
 <div class="wp-block-embed__wrapper   ">
  <div id="ep-gutenberg-content-cf9e0f2bd221a297aaaaf694b4ef76ba" class="ep-gutenberg-content">
   <div>
    <div class="ep-embed-content-wraper  insta-grid  ">
     <div class="ose-twitter ose-uid-c4662e6db7c7476d9d064652e5746c3f ose-embedpress-responsive" style="width: 100%; height:600px; max-height:600px; max-width:100%; display:inline-block;">
      <blockquote class="twitter-tweet">
       <p>Update on the NPM attack: The attack fortunately failed, with almost no victims.🔒<br><br>It began with a phishing email from a fake npm support domain that stole credentials and gave attackers access to publish malicious package updates. The injected code targeted web crypto activity,… <a href="https://t.co/Ud1SBSJ52v" rel="noopener noreferrer nofollow">https://t.co/Ud1SBSJ52v</a> <a href="https://t.co/lOik6k7Dkp" rel="noopener noreferrer nofollow">pic.twitter.com/lOik6k7Dkp</a></p>— Charles Guillemet (@P3b7_) <a href="https://twitter.com/P3b7_/status/1965336272550899932?ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">September 9, 2025</a>
      </blockquote>
     </div>
    </div>
   </div>
  </div>
 </div>
</div>
<p>As Guillemet summed it up, “If your funds sit in a software wallet or exchange, you’re one code execution away from losing everything.”</p>
<h2 class="wp-block-heading" id="what-developers-should-do-now">What Developers Should Do Now</h2>
<p>For teams, the advice is straightforward but critical:</p>
<ul>
 <li><strong>Audit dependencies:</strong> Check every library, especially transitive ones you don’t interact with directly.</li>
 <li><strong>Pin versions:</strong> Avoid vague ranges that automatically pull the newest update.</li>
 <li><strong>Regenerate lockfiles:</strong> Start clean to ensure no infected version lingers.</li>
 <li><strong>Use overrides:</strong> Enforce safe versions across large projects.</li>
</ul>
<p>This isn’t just about this attack. It’s about reducing risk for the next one.</p>
<h2 class="wp-block-heading" id="the-bigger-picture">The Bigger Picture</h2>
<p>The <a href="https://www.cryptotimes.io/2025/09/09/ledger-cto-warns-users-amid-massive-npm-supply-chain-attack/" target="_blank" rel="noopener noreferrer nofollow">NPM attack</a> is a reminder of how fragile modern development really is. A single phishing email was enough to compromise libraries used by millions of developers.</p>
<p>While the financial damage was negligible this time, the potential wasn’t. If the malware had worked as intended, it could have drained wallets at scale.</p>
<p>There are three lessons worth underlining:</p>
<ul>
 <li>Core utilities are high-value targets. Small, boring packages run everywhere, making them perfect attack vectors.</li>
 <li>Phishing remains painfully effective. Social engineering bypasses even the best technical defenses.</li>
 <li>Independent verification is essential. Hardware wallets, reproducible builds, and strict dependency policies are no longer optional luxuries.</li>
</ul>
<h2 class="wp-block-heading" id="final-word">Final Word</h2>
<p>This incident could easily have been catastrophic. Instead, it will likely be remembered as a warning. A warning about trust, about dependency sprawl, and about the need for vigilance.</p>
<p>The fact that it was stopped by a random crash, not a monitoring system, should worry everyone. Next time, we might not get so lucky.</p>
<p>For now, the immediate threat is gone. But the lesson remains: open source runs on trust, and that trust needs constant protection.</p>
<blockquote class="wp-block-quote is-layout-flow wp-block-quote-is-layout-flow">
 <p>Also Read: <a href="https://www.cryptotimes.io/2025/09/05/venus-recovers-13m-after-phishing-attack-disrupts-protocol/" target="_blank" rel="noopener noreferrer nofollow">Venus Recovers $13M After Phishing Attack Disrupts Protocol</a></p>
</blockquote>

Crypto Ecosystem Avoids Disaster After JavaScript NPN Attack

Table of Contents

The Crypto Times

Other articles published on Sep 9, 2025

Join our free newsletter for daily crypto updates!