Anatomy of a supply chain attack

The great NPM heist of September 2025

On September 8, 2025, a supply chain attack compromised at least 20+ popular NPM packages, including the widely used “chalk” and “debug” libraries. With a combined total of over 2.5 billion weekly downloads, these packages are foundational code in countless web applications, which made the attack’s potential reach enormous.

How it happened: a phishing expedition

The attack began with a phishing campaign targeting the maintainers of these packages. The attackers sent convincing emails from a fraudulent domain, npmjs.help, to urge maintainers to update their two-factor authentication (2FA) credentials. The email created a false sense of urgency, threatening to lock accounts within 48 hours. One prominent developer, known as “Qix”, fell victim to the scheme, inadvertently handing over their NPM account credentials including their username, password, and a one-time password.

With control of that account, the attackers published malicious new versions of the compromised packages. A single point of failure let the damage spread through the JavaScript ecosystem, because developers and automated build systems unknowingly pulled in the compromised code.

The malicious payload: a crypto-clipper

The injected code was malware known as a “crypto-clipper” or “drainer,” designed to steal cryptocurrency from Web3 users. When a user of an affected website made a cryptocurrency transaction, the malware intercepted it and swapped the intended recipient’s wallet address for one belonging to the attackers.

The attackers used a fuzzy matching algorithm to pick an attacker’s wallet address that was visually similar to the user’s intended destination. That made the switch much harder to spot, so the theft was more likely to succeed.

The aftermath: a near miss

The malicious packages were available on the NPM registry for approximately two hours before the community detected the compromise and the packages were removed. In that short window, however, the compromised code was downloaded millions of times, and it is estimated that the malicious payload made its way into about 10% of cloud environments.

Fortunately, the actual financial damage from the attack appears to have been minimal, with reports suggesting that the attackers only managed to steal about $50 worth of Ethereum. The primary impact of the attack was the disruption it caused to the developer community. Teams using the affected packages were forced to scramble to audit their dependencies, purge their build caches, and redeploy their applications to ensure they were not serving malicious code to their users.

Lessons learned

This incident shows how fragile the open-source software supply chain can be. The lessons:

• Vigilance against phishing attacks: be extremely cautious about any email asking for credentials or security updates, even if it looks like it comes from a trusted source.
• Dependency management: audit and update dependencies regularly so you do not end up using compromised packages.
• Security best practices: dependency scanning in CI/CD pipelines can catch malicious code before it reaches production.

The September 2025 NPM supply chain attack was a wake-up call for the JavaScript community. The direct financial damage was limited, but the incident showed how much disruption a single compromised package can cause, and how much open-source security practices still need to improve.

ansi-regex@6.2.1
ansi-styles@6.2.2
backslash@0.2.1
chalk-template@1.1.1
chalk@5.6.1
color-convert@3.1.1
color-name@2.0.1
color-string@2.1.1
color@5.0.1
@coveops/abi@2.0.1
debug@4.4.2
@duckdb/duckdb-wasm@1.29.2
@duckdb/node-api@1.3.3
@duckdb/node-bindings@1.3.3
duckdb@1.3.3
has-ansi@6.0.1
is-arrayish@0.3.3
prebid@10.9.1
prebid@10.9.2
simple-swizzle@0.2.3
slice-ansi@7.1.1
strip-ansi@7.1.1
supports-color@10.2.1
supports-hyperlinks@4.1.1
wrap-ansi@9.0.1
proto-tinker-wc@0.1.87
...