Open-Source Supply Chain Breach Hijacks Crypto Transactions via NPM

A significant supply chain attack on the JavaScript ecosystem, specifically targeting the Node Package Manager (NPM), has raised concerns over the security of open-source software in the crypto industry. On September 8, 2025, attackers compromised the NPM account of a high-profile developer, Josh Junon (also known as qix), through a sophisticated phishing campaign. The breach allowed the injection of malicious code into 18 widely used JavaScript packages, including chalk, color-convert, and error-ex, which collectively receive approximately 2.6 billion weekly downloads. These packages are integral to many web and blockchain-related applications, making the breach particularly alarming for developers and users in the decentralized finance (DeFi) and cryptocurrency sectors.

The phishing attack involved a fraudulent email impersonating NPM support, prompting the developer to update his two-factor authentication (2FA). The email contained a link to a malicious site hosted on a domain that closely resembled the official NPM support address. Once credentials and 2FA codes were obtained, attackers used them to publish malicious versions of the packages on the NPM registry. The malware embedded in the packages was designed to intercept and modify cryptocurrency transactions within web browsers, redirecting funds to attacker-controlled wallets across multiple blockchains, including Ethereum, Solana, and Bitcoin.

The malicious code operated in two modes, depending on whether a crypto wallet was detected on the user's browser. In passive mode, it replaced wallet addresses with visually similar ones using the Levenshtein distance algorithm, making it difficult to detect the changes. In active mode, the malware intercepted transaction data at the point of signing, altering the recipient address just before the transaction was confirmed. Although users were still required to approve the transaction, the small differences in addresses could easily go unnoticed, especially in fast-paced trading environments.

The attack was discovered relatively quickly, thanks to automated security systems and community vigilance. Aikido Security detected the malicious code at 13:21 UTC, just five minutes after the first compromised package was published. Public alerts followed, and by 17:20 UTC, NPM confirmed the removal of the affected packages. Ledger's CTO, Charles Guillemet, was among the first to publicize the breach, noting the potential widespread impact on the JavaScript ecosystem. However, the actual financial damage appears to have been limited. Arkham Intelligence reported only $1,043.21 in stolen funds, including $436.84 that was likely sent as a taunt.

Despite the relatively low monetary loss, the attack underscores the vulnerabilities within the open-source software supply chain. The compromised packages were used by a wide range of projects, including some high-profile DeFi applications and wallet services. While Ledger, Phantom, and MetaMask confirmed no impact from the incident, the potential for more extensive damage remained high. The malware could have been used to redirect transactions silently or even manipulate smart contracts, leading to irreversible losses.

In response, the NPM community and affected developers acted swiftly to mitigate the threat. Clean versions of the affected packages were published, and advisories were issued to prompt upgrades. Tools like Etherscan and Solscan flagged the attacker's addresses, enhancing visibility for users and developers. Additionally, developers were advised to enforce strict version pinning, update lockfiles, and monitor their dependency chains for any signs of compromise.

The incident highlights the importance of robust security practices in open-source development. Maintainers are urged to adopt phishing-resistant multi-factor authentication and cryptographic package signing to prevent similar breaches in the future. Organizations are also encouraged to implement automated scanning and monitoring systems to detect and respond to supply chain threats in real time.