In what appears to be the largest supply chain attack to date, threat actors compromised a maintainer's account and injected malware into several popular NPM packages, collectively downloaded over 2.6 billion times per week.
In posts to Bluesky and GitHub, Josh Junon, aka ‘qix,’ the maintainer of widely used NPM packages, confirmed his account was hijacked following a sophisticated phishing attack. The attackers used a deceptive email from "support@npmjs[.]help," a domain impersonating the legitimate npmjs.com, to trick Junon into clicking a malicious link.
The phishing email warned that accounts with outdated Two-Factor Authentication (2FA) would be locked starting September 10, 2025, using urgency and official-sounding language to pressure recipients. Other developers and maintainers reported receiving similar emails.
After gaining access to Junon’s account, the attackers updated multiple packages, including the popular "debug" package (357.6 million weekly downloads), to include malicious code. According to Aikido Security, which analyzed the breach, the injected code acts as a browser-based interceptor, modifying index.js files to hijack cryptocurrency transactions and web3 wallet interactions.
The malware targets users accessing affected applications via the web. It silently monitors for crypto wallet addresses and transactions involving Ethereum, Bitcoin, Solana, Tron, Litecoin, and Bitcoin Cash. When detected, the code intercepts and reroutes the transactions to attacker-controlled wallet addresses.
To execute this, the malware hooks into JavaScript functions such as fetch, XMLHttpRequest, and wallet APIs like window.ethereum, allowing it to manipulate network traffic and application APIs directly in the browser. The list of affected packages can be found here.
The NPM security team has since removed several malicious package versions, but the full scope of the compromise is still being assessed. Developers using popular NPM packages are urged to verify package integrity, audit recent updates, and rotate credentials where necessary.
The incident follows a recent large-scale GitHub supply chain attack, dubbed ‘GhostAction,’ that has compromised more than 320 GitHub users and exposed thousands of secrets across the software development ecosystem.