Ledger CTO: A large-scale Supply Chain attack is currently occurring, and the entire JavaScript ecosystem may be at risk.

On September 9, Ledger's Chief Technology Officer Charles Guillemet posted that "a large-scale Supply Chain attack is currently occurring: the NPM account of a well-known developer has been compromised. The affected package has been downloaded over 1 billion times, which means the entire JavaScript ecosystem may be at risk. The malicious code works by silently tampering with Crypto Assets addresses in the background to steal funds. If you are using a hardware wallet, please carefully verify each signed transaction, you are safe. If you are not using a hardware wallet, please temporarily avoid any on-chain transactions. It is currently unclear whether the attacker has already directly stolen the mnemonic phrase from software wallets. Detailed report. If you are using a Ledger or another hardware wallet that supports clear signatures, you will not be affected. My previous tweet was a reminder: users not using hardware wallets that support clear signatures are at risk. Please be sure to carefully check each transaction before signing."