Ethereum, Solana Wallets Targeted in 'Npm' Attack With Billions of Downloads, Just 5 Cents Taken

This 2FA phishing scam pwned a developer - and endangered billions of npm downloads

'Stay vigilant.' Other maintainers have been targeted, too.

Ethereum, Solana Wallets Targeted in 'npm' Attack With Billions of Downloads, Just 5 Cents Taken

The credential stealer harvested username, password, and 2FA codes before sending them to a remote host. With full access, the attacker republished every "qix" package with a crypto-focused payload.

npm Attack Hits 18 Packages With 2B Weekly Downloads

A major supply-chain attack compromised 18 popular npm packages — including chalk, debug, ansi-styles, and supports-color — planting malware that secretly redirects crypto transactions. Aikido researchers noted, “What makes it dangerous is that it operates at multiple layers: altering content shown on websites, tampering with API calls, and manipulating what users’ apps believe they are signing.” What happened? Beginning Sept. 8, 2025, attackers…

Popular packages impacted by largest npm supply chain intrusion yet

Malware has been deployed on 18 widely used developer utilities with over 2.6 billion weekly downloads as part of the largest npm supply chain attack so far, SiliconANGLE reports. Introduction to Malware Binary Triage (IMBT) Course Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor. Enroll Now and Save 10%: Coupon Code MWNEWS10 Note: Affiliate link – your enrollment helps support this platform at no extra co…

Phishing, Bugs, and Billions at Stake: Lessons From NPM Crypto Exploit Near-Miss

A failed attack on popular Node Package Manager (NPM) libraries sent shockwaves through the crypto world on Monday. . Hackers targeted major packages to hijack cryptocurrency transactions across mu...