Ethereum

Charlie

Planet

Ethereum Name Service

<h4>Quick Breakdown&nbsp;</h4>
<ul>
 <li>Over 400 JavaScript packages found infected with the self-replicating “Shai Hulud” malware.</li>
 <li>At least 10 widely used crypto-related packages, mostly tied to Ethereum Name Service, were compromised.</li>
 <li>Researchers warn the attack is rapidly escalating, adding 1,000 infected repositories every 30 minutes.</li>
</ul>
&nbsp;
<h3 id="span-massive-npm-malware-outbreak-exposes-crypto-developers-span">Massive NPM malware outbreak exposes crypto developers</h3>
A sweeping JavaScript supply-chain attack has compromised hundreds of open-source packages, including several foundational tools used across the crypto ecosystem, according to new <a href="https://www.aikido.dev/blog/shai-hulud-strikes-again-hitting-zapier-ensdomains" rel="noopener noreferrer nofollow">research</a> from cybersecurity firm Aikido Security.
<blockquote class="twitter-tweet">
 Shai Hulud also compromised these packages:
 – @ensdomains/ens-validation – @ensdomains/content-hash – ethereum-ens – @ensdomains/react-ens-address – @ensdomains/ens-contracts – @ensdomains/ensjs – @ensdomains/ens-archived-contracts – @ensdomains/dnssecoraclejs<a href="https://twitter.com/ensdomains?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">@ensdomains</a>
 — Charlie Eriksen (@CharlieEriksen) <a href="https://twitter.com/CharlieEriksen/status/1992868380794294690?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">November 24, 2025</a>
</blockquote>

The malware, known as “Shai Hulud,” was discovered embedded in more than 400 NPM libraries. Aikido researcher Charlie Eriksen said each detection was manually verified to eliminate false positives, calling the outbreak’s scale “massive.”
Shai Hulud is part of a growing wave of supply-chain attacks targeting developer infrastructure. While an earlier NPM breach in September led to the theft of $50 million in crypto, the new worm is designed for autonomous credential theft, quietly siphoning off secrets, including wallet keys stored on infected machines.
<h3 id="span-ens-tools-among-the-hardest-hit-span">ENS tools among the hardest hit</h3>
More than 10 cryptocurrency-related packages have been confirmed compromised. Nearly all are tied to the Ethereum Name Service (ENS), prompting Eriksen to issue a direct warning to the ENS team on X.
Some of the most-downloaded infected libraries include content-hash, address-encoder, ensjs, ethereum-ens, ens-validation and ens-contracts. Another high-volume crypto tool, crypto-addr-codec, was also compromised, averaging nearly 35,000 downloads a week.
Given their deep integration within wallets, dApps, and blockchain infrastructure, the risk of downstream compromise is significant.
<h3 id="span-high-traffic-non-crypto-packages-also-infected-span">High-traffic non-crypto packages also infected</h3>
The malware’s reach extends far beyond crypto. Popular packages from corporate automation platform Zapier are among those affected, including one with more than 40,000 weekly downloads.
Eriksen later identified additional infected libraries approaching 70,000 weekly downloads, and one exceeding 1.5 million downloads per week, underscoring how deeply the worm has penetrated the NPM ecosystem.
<h3 id="span-researchers-warn-outbreak-is-accelerating-span">Researchers warn outbreak is accelerating</h3>
Cybersecurity firm Wiz reported detecting over 25,000 infected repositories spanning 350+ users, with roughly 1,000 new compromised repositories appearing every 30 minutes over the past few hours.
The firm urged all developers using NPM to begin immediate audits, dependency checks, and remediation of environments. In April, the XRP Ledger Foundation <a href="https://defi-planet.com/2025/04/xrp-ledger-faces-javascript-library-breach-but-xrp-token-defies-security-scare-with-price-surge/" rel="noopener noreferrer nofollow">flagged</a> a critical security vulnerability in its official JavaScript library, a widely used tool for developers to interact with the XRP Ledger blockchain.&nbsp;
&nbsp;
If you would like to read more articles like this, visit<a href="https://defi-planet.com/wp-content/uploads/2025/09/Barriers-and-Skepticism-in-Apples-crypto-security-push-1-3.avifwp-content/uploads/2025/09/Barriers-and-Skepticism-in-Apples-crypto-security-push-1-2.avifwp-content/uploads/2025/10/Proof-of-Personhood-A-Privacy-First-Approach-to-Identity-Verification-scaled-1.avifwp-content/uploads/2025/10/Are-We-Ignoring-the-Ethics-of-Crypto-Staking-scaled-2.avifwp-content/uploads/2025/10/Slippage-Front-Running-and-MEV-The-Hidden-Costs-of-DeFi-Trading-scaled-1.avifwp-content/uploads/2025/09/Next-Technology-Holding-1.avifwp-content/uploads/2025/09/Next-Technology-Holding-1.avifwp-content/uploads/2025/10/Russian-Ruble-Backed-Stablecoin-A7A5-1.avifwp-content/uploads/2025/10/IoTeX-1.avifwp-content/uploads/2025/09/Pepeto-eth-ethereum__17576735955xmMW0sU5j-1.jpgwp-content/uploads/2025/10/featured_BitMine_Dark_Background___Logo_1759753804_1759753804OCMtn2Egta-1.avif" rel="noopener noreferrer nofollow"> DeFi Planet</a> and follow us on<a href="https://twitter.com/PlanetDefi" rel="noopener noreferrer nofollow"> Twitter</a>,<a href="https://www.linkedin.com/company/defi-planet/" rel="noopener noreferrer nofollow"> LinkedIn</a>,<a href="https://www.facebook.com/DeFi-Planet-129907662611402" rel="noopener noreferrer nofollow"> Facebook</a>,<a href="https://www.instagram.com/defi.planet/" rel="noopener noreferrer nofollow"> Instagram</a>, and<a href="https://coinmarketcap.com/community/profile/DeFiPlanet/" rel="noopener noreferrer nofollow"> CoinMarketCap Community</a>.
Take control of your crypto&nbsp; portfolio with MARKETS PRO, DeFi Planet’s suite of analytics tools.”
The post <a href="https://defi-planet.com/2025/11/javascript-supply-chain-attack-infects-key-crypto-packages-ens-libraries-hit-hard/" rel="noopener noreferrer nofollow">JavaScript Supply-Chain Attack Infects Key Crypto Packages, ENS Libraries Hit Hard</a> appeared first on <a href="https://defi-planet.com" rel="noopener noreferrer nofollow">DeFi Planet</a>.

JavaScript Supply-Chain Attack Infects Key Crypto Packages, ENS Libraries Hit Hard

Table of Contents

DeFi Planet

Other articles published on Nov 24, 2025

Join our free newsletter for daily crypto updates!