Massive npm supply‑chain compromise injects browser crypto‑stealer into 18 packages

Key update

On September 8, 2025, attackers phished the npm account of a prolific maintainer (Qix / Josh Junon) and published malicious releases across 18 packages with a combined weekly download count measured in the billions; the injected code executes in browsers to intercept wallet/network APIs and rewrite cryptocurrency recipients so funds are diverted to attacker-controlled addresses. (pt.aikido.dev)

Why it matters

This is not a theoretical repository compromise: these packages (chalk, debug, ansi‑styles and several small but highly transitive utilities) sit in huge dependency graphs and are routinely bundled into frontend builds. The payload only runs in browser contexts, so servers running Node.js were not directly executing the malicious logic, but any build that included the trojaned versions and shipped frontend assets could have exposed end users’ crypto flows during the short live window. Containment actions taken by the community and registry removed the versions quickly, but remediation is operationally painful: teams must pin and rebuild artifacts, purge caches and CDNs, verify lockfiles and deployment artifacts, and treat this as a live supply‑chain incident for incident response and post‑mortem work. (pt.aikido.dev)

Source

• Source