The largest NPM Supply Chain attack in history! Core JS library compromised, encryption user funds may be stolen.

The global JavaScript ecosystem is facing the largest NPM Supply Chain attack in history. Hackers have breached the Node Package Manager (NPM) account of a well-known developer, injecting malicious code into core JavaScript libraries relied upon by millions of applications, directly targeting the Wallet funds of Crypto Assets users.

Attack Details: Core Library Infected with 'Encryption Clipper'

According to multiple security reports, the affected packages include small utilities such as chalk, strip-ansi, and color-convert, which are deeply embedded in the dependency tree of countless projects, with weekly download volumes exceeding 1 billion.

Malicious Function: Silently replaces the crypto wallet address during the transaction process (commonly known as "crypto clipper")

Potential risk: Users may unknowingly transfer funds to addresses controlled by hackers.

Ledger Chief Technology Officer Charles Guillemet warned: "The entire JavaScript ecosystem may be in danger."

Encryption users become high-risk targets

Security researchers point out that users relying on software Wallets face the highest risk, as malicious code can alter transaction details in web pages or applications.

Hardware Wallet users are relatively secure because each transaction needs to be confirmed on a physical device.

DefiLlama founder 0xngmi reminds that malicious code will not automatically empty the Wallet, but will tamper with the transaction content when users click "swap" or "confirm".

Due to users being unable to easily identify which websites have updated to secure versions, experts recommend pausing encrypted transactions on sites with uncertain security until the affected packages are fully cleared.

Attack Method: Phishing Email to Capture Maintainer Account

(Source: Github)

Attackers disguise themselves as official NPM-supported phishing emails to lure maintainers into updating their two-factor authentication on a fake website, thereby stealing login credentials.

Once hackers gain control of the account, they can push malicious updates to packages that have been downloaded billions of times.

Aikido Security researcher Charlie Eriksen stated that the danger of this attack lies in its ability to "simultaneously manipulate the displayed content on websites, API calls, and the transaction data that user applications believe they are signing."

Why is this the "largest Supply Chain attack in history"?

Wide impact: Affects millions of applications and websites.

High penetration depth: the core library is located at the bottom of the dependency chain, and may be affected even if not directly installed.

Highly targeted: Specifically focused on crypto trading and wallet funds

This means that the entire chain, from front-end developers to end users, may become a target for attacks.

Conclusion

The recent NPM supply chain attack highlights the vulnerability of the open-source ecosystem and the high risks of the crypto market. For developers, it is essential to immediately check and roll back to a secure version; for crypto users, it is advisable to avoid trading on websites with uncertain security in the short term and to use hardware Wallets for asset management whenever possible.