Crypto Clipper in the Supply Chain: The NPM Breach Every Developer Should Know About

A developer fell victim to a phishing email that allowed attackers to gain control of his account and insert malicious code into trusted packages. If you deal with crypto or use NPM, this could affect you, too.

In this blog, we’ll look at what the attacker did, the extent of the damage, how you can protect yourself, and what it means going forward. 

How the Breach Happened

Prominent NPM maintainer Josh Junan, also known as Kix, was hit by a phishing attack that reset two-factor authentication on his account. The attackers then injected malicious updates into at least 18 packages, including Chalk debug strips and styles, and others. These packages together have over 2 billion downloads each week, with some reports putting the number as high as 2.6 billion. 

The malware injected was a crypto clipper. It intercepts web3 or crypto transactions in the browser and silently changes wallet addresses, redirecting funds to an account controlled by the attacker without raising any significant alarm. Fortunately, this attack was quickly discovered by Iikido, a Belgian security company. 

How the Malware Works (Step by Step)

• Injects itself into the browser
• Watches for sensitive data
• Rewrites the targets
• Hijacks transactions before they’re signed
• Stays stealthy

The phishing email

The developer himself reported that his account was hacked through phishing. He received an email from support[at]npmjs[dot]help, appearing to be from official support for npm (a popular package registry). However, it was actually a fake email, asking him to click on something or log in, which led to his account being stolen.

This means that someone posing as npm support tricked him—and this is the exact method of phishing.

Maintainer response

After Aikido notified the maintainer on Bluesky, he responded at 15:15 UTC that he had realized the package had been compromised and was now starting to clean it up.

He also stated that the phishing email came from support [at] npmjs [dot] help.

The good news is that he had deleted most of the compromised packages before losing access to his account. However, Simple-Swizzle is still compromised.

Even though only a few users were directly affected, this incident shows how fragile and far-reaching the trust in the supply chain can be. The rapid response minimized the damage. Many compromised versions were removed within an hour, but some cached lock files or indirect dependencies may still harbor malware, so be extra vigilant.

You can do this to protect yourself and your projects.

• Audit your packages. 
• Run an npm audit. 
• Check your log files and update or remove any compromised versions. 
• Clear your local cache. 
• Run an npm cache clean with the force flag and reinstall dependencies to extract clean packages. 
• And if you’re using crypto, use a hardware wallet or carefully verify addresses.

The Ledger CTO recommends caution with on-chain transactions. If you use a hardware wallet, double-check every destination address before approving. And finally, adopt supply chain defenses. Use tools that detect malicious package changes, monitor registry updates, and flag suspicious code. This attack is a stark reminder that there are real risks in the open-source ecosystem, even from trusted contributors.

This whole thing is a wake-up call for anyone relying on open-source. One fake email almost slipped malware into billions of downloads. Money lost this time? Not much. But next time, who knows? Your best bet: run regular audits, stay alert, and talk about these risks with your team. Pass the word along. Stay sharp.

Source: https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised