Rotate

Ethereum

when

Security

Ethereum Name Service

<ul>
 <li>Over 400 NPM packages infected by a malicious worm</li>
 <li>ENS and crypto libraries among the affected</li>
 <li>Attackers stole wallet keys and developer credentials</li>
</ul>
<p>In a significant security incident, more than 400 NPM packages have been compromised by a sophisticated worm-style attack. The breach affected numerous key crypto-related libraries, including those connected to the Ethereum Name Service (ENS), sending shockwaves across the blockchain developer community.</p>
<p>According to initial reports, the worm infiltrated the packages and silently stole sensitive data such as wallet private keys and developer credentials. This method of attack is especially dangerous as it spreads from one package to another, increasing its reach with every compromised dependency.</p>
<h2 class="wp-block-heading" id="key-crypto-libraries-compromised">Key Crypto Libraries Compromised</h2>
<p>Some of the impacted packages include vital libraries used by developers building on Ethereum and other blockchain networks. This includes packages related to ENS, a widely used decentralized domain service on Ethereum. These libraries are often integrated deep within larger projects, making the worm’s reach extensive and dangerous.</p>
<p>The attack highlights vulnerabilities in software supply chains, especially when developers rely on open-source packages without rigorous audits. Once a developer installs an infected package, their credentials and wallet data could be silently exfiltrated, putting both personal and project assets at risk.</p>
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper">
  <blockquote class="twitter-tweet">
   <p>ALERT: Over 400 NPM packages, including key ENS and crypto libraries, were hit by a worm-style attack stealing dev credentials and wallet keys. <a href="https://t.co/z4yBjhHrRa" rel="noopener noreferrer nofollow">pic.twitter.com/z4yBjhHrRa</a></p>— Cointelegraph (@Cointelegraph) <a href="https://twitter.com/Cointelegraph/status/1992983261182914704?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">November 24, 2025</a>
  </blockquote>
 </div>
</figure>
<h2 class="wp-block-heading" id="what-developers-should-do-now">What Developers Should Do Now</h2>
<p>Security experts recommend that all developers using NPM, especially in Web3 or crypto-related projects, conduct immediate audits of their dependencies. Here are some steps to take:</p>
<ul>
 <li><strong>Check for recent updates</strong> to any packages related to ENS or wallet functionality.</li>
 <li><strong>Review NPM package maintainers</strong> and verify the integrity of packages you depend on.</li>
 <li><strong>Rotate developer credentials</strong> and regenerate any wallet keys that may have been exposed.</li>
 <li><strong>Use security tools</strong> that monitor for malicious behavior in dependencies.</li>
</ul>
<p>This incident serves as a stark reminder that even trusted package ecosystems like NPM can be vectors for large-scale attacks. Vigilance and quick action are crucial in minimizing damage and preventing future compromises.</p>
<p>The post <a href="https://coinomedia.com/npm-worm-attack-crypto/" rel="noopener noreferrer nofollow">NPM Worm Attack Hits 400+ Crypto Packages</a> appeared first on <a href="https://coinomedia.com" rel="noopener noreferrer nofollow">CoinoMedia</a>.</p>

NPM Worm Attack Hits 400+ Crypto Packages

Table of Contents

CoinoMedia

Other articles published on Nov 25, 2025

Join our free newsletter for daily crypto updates!