16 Minutes to Impact: npm Supply Chain Abuse Deploys crypto-draining malware

Executive summary

On September 8, 2025, a phishing campaign targeting a maintainer of the widely used ‘chalk’ package escalated into one of the most severe supply chain compromises observed in the npm ecosystem to date. Within approximately 16 minutes of gaining account access, attackers injected malicious code into at least 18 trusted JavaScript packages which, collectively, are downloaded over two billion times per week. 

‘chalk’, a popular Node.js library used for styling console output, became the distribution vector for cryptocurrency-draining malware. The injected code employed advanced evasion techniques to intercept wallet transactions and manipulate application behavior, enabling theft while concealing malicious activity from end users. 

Although containment efforts have so far limited direct financial losses to approximately $500 in cryptocurrency, the incident underscores the structural fragility of open-source supply chains. The speed and technical sophistication of this incident highlights the significant potential for disruption, particularly for organizations operating in cryptocurrency, fintech, and decentralized finance. While supporting clients through crypto-related incident response effort, we consistently observe attackers begin by compromising individual developers or DevOps personnel, then pivot to client-side transaction manipulation. This tactic exploits trusted software dependencies into direct asset exposure. We are also seeing a growing trend where attackers target end users as the initial access vector, exploiting ordinary web sessions to carry out unauthorized transfers without triggering backend anomalies. 

To strengthen resilience against similar threats, organizations should prioritize the following actions: 

• Audit for Exposure: Verify whether compromised package versions were used or are currently being used in applications, pipelines, or services. 
• Secure Credentials: Rotate API keys, tokens, and secrets that were potentially exposed in affected environments. 
• Update and Redeploy: Rebuild applications with clean dependencies and redeploy them to eliminate malicious code. 
• Adopt Supply Chain Controls: Implement automated dependency scanning and SBOM practices to detect malicious packages early. 

This advisory summarizes the compromise, its implications for crypto businesses, and concrete steps to reduce risk. 

Incident Overview: From Maintainer Account to Supply Chain Compromise

The compromise originated from a carefully orchestrated phishing campaign, highlighting the growing sophistication of social engineering attacks targeting open-source maintainers. By exploiting the trust placed in individuals with publishing access to widely used npm packages, the attackers were able to weaponize open-source code using it as an infiltration point to target cryptocurrency users and platforms. Within minutes of gaining access, the attackers injected malware into trusted dependencies, enabling large-scale distribution through the npm ecosystem. 

The intrusion unfolded as follows: 

• On September 5, 2025, attackers registered a deceptive domain, npmjs[.]help, designed to impersonate official npm support. 
• Maintainers received phishing emails impersonating npm security personnel, warning that accounts would be locked unless two-factor authentication (2FA) settings were updated within 48 hours. 
• Josh Junon (alias qix), maintainer of ‘chalk’, entered credentials into the fraudulent portal, granting attackers full access to his npm account. 
• Within approximately 16 minutes, attackers injected malware into multiple package versions, allowing widespread distribution via npm. 

The malware, specifically tailored for JavaScript browser environments, was engineered to enable cryptocurrency theft through stealthy manipulation techniques. It hooked into critical browser APIs including ‘fetch()’, ‘XMLHttpRequest’, and ‘window.ethereum’ to silently monitor network traffic and wallet interactions. This granted attackers full visibility into sensitive operations without alerting users or triggering security controls. This incident highlights how rapidly adversaries can exploit stolen maintainer credentials to subvert trusted dependencies at a global scale. 

Impact Overview: Risks to Applications, Transactions, and Trust

This compromise illustrates how a single breached maintainer account can jeopardize billions of downstream downloads, eroding trust in the open-source supply chain. Although the reported financial theft totaled approximately $500 in cryptocurrency, the malware’s sophistication poses much broader risks. 

The malware’s effectiveness relied on two primary capabilities: 

• Web traffic injection: Intercepting and modifying web page content or API responses before application logic processed them, enabling silent data manipulation. 
• Transaction interception: Replacing cryptocurrency wallet addresses at execution time while preserving the appearance of legitimate transactions in the user interface. 

Additional advanced features have amplified the threat: 

• Visually similar address replacement: Wallet addresses were substituted with nearly identical addresses, significantly reducing the likelihood of detection by end users. 
• Exfiltration of developer secrets: Systems that installed or built with the compromised packages may have inadvertently exposed credentials, API keys, or environment variables. 

Broader implications include: 

• Widespread exposure of applications and services built on compromised components. 
• Cascading impacts across blockchain networks and DeFi platforms: The attack demonstrated how a single compromised package, running in the same execution context as Web3 wallets and decentralized applications could be used not only to intercept transactions but also to alter content and API calls within any web application.  

The same attack method could be used to steal credentials, session tokens, or other sensitive data, extending the impact well beyond cryptocurrency theft and into general web application compromise. 

Technical Analysis: Malware Behavior and Attack Timeline

Malware Capabilities

The injected payload was designed specifically to operate in browser environments, where it could monitor and manipulate user activity without triggering alerts. Its architecture prioritized silent cryptocurrency theft and incorporated safeguards to avoid execution in server-side or non-browser contexts. 

Key capabilities included: 

• Web and wallet activity interception: The malware hooked into standard browser APIs to observe data flows and monitor cryptocurrency-related activity. 
• Multi-chain targeting: It was engineered to manipulate transactions across several major blockchains, including Ethereum, Bitcoin, Solana, TRON, Litecoin, and Bitcoin Cash. 
• Real-time address and transaction manipulation: The malware dynamically altered wallet addresses or modified transaction parameters during execution, redirecting funds while leaving user interfaces unchanged. 
• Stealth and persistence features: Obfuscation, delayed execution, and concealed logic were used to evade detection and prolong presence in the host environment. 
• Execution context awareness: To avoid triggering alerts during server-side operations, the payload remained inactive in Node.js environments and only executed in browser-like contexts.

Detection Indicator 

An early indicator of compromise appeared when build pipelines began failing with the error: ‘ReferenceError: fetch is not defined’ 

This anomaly was triggered by the malware’s attempt to invoke the fetch() API, a function native to browser environments but absent in Node.js. As a result, the error surfaced during server-side builds, disrupting continuous integration workflows and providing an early signal for defenders to investigate. 

Attack Timeline

September 5, 2025 — Attackers register phishing domain: npmjs[.]help 

September 8, 2025 – 13:00 UTC — Phishing email sent to chalk maintainer Josh Junon (qix) 

September 8, 2025 – 13:16 UTC — First malicious package published; attackers deploy payload within ~16 minutes of account compromise 

September 8, 2025 – 14:16 UTC — Developer community raises suspicions of account compromise on Bluesky 

September 8, 2025 – 15:15 UTC — Maintainer acknowledges breach and begins remediation 

September 8, 2025 – 15:16 UTC — Public confirmation of compromise posted on Bluesky; npm Security notified 

September 8, 2025 – 17:17 UTC — npm confirms breach and initiates takedown of affected packages 

September 8, 2025 – 19:59 UTC — npm confirms all impacted versions of chalk and related packages have been removed 

September 9, 2025 — Residual malicious versions of Impacted packages (e.g., simple-swizzle) are removed following final cleanup efforts 

Immediate Actions for Development and Operations Teams

Secure Secrets and Tokens 

Assume that secrets may have been exfiltrated from ‘build’ or ‘runtime’ environments where compromised packages were present. 

• Rotate all private keys, API tokens, and credentials used in affected CI/CD pipelines and applications. 

Audit Dependencies 

• Inventory all applications, services, and build pipelines for use of affected package versions. 
• Use lockfiles (package-lock.json, yarn.lock) or a Software Composition Analysis (SCA) tool to pinpoint instances of vulnerable packages. 
• Use a read-only dependency scanner to identify compromised package versions listed in this advisory. For example, the Open Tools Vulnerable Packages Scanner supports npm, yarn, pnpm, and bun lockfiles, generates a JSON report, and can be integrated into CI pipelines to fail builds when a match is detected. 
• Begin with a scan only or dry run mode. Once confirmed, replace affected packages, regenerate lockfiles, and redeploy updated applications. 

Remove and Replace Malicious Packages 

• Uninstall compromised versions immediately and upgrade to patched releases (e.g., [email protected] or later). 
• If a patch is not out yet, roll back to the last known good version before the incident (e.g., downgrade [email protected] to 6.0.0) and lock your dependency there. 
• Perform a clean reinstall: 
• Delete the node_modules directory. 
• Clear the npm cache. 
• Regenerate lockfiles to ensure all code is sourced from trusted versions. 

Rebuild and Redeploy 

• Recompile and redeploy all applications that previously included compromised dependencies to remove malicious code from runtime environments. 
• For web applications, publish clean client-side builds immediately to eliminate malware exposure for new sessions. 

Publish Guidance for End Users 

• Verify all cryptocurrency transactions. Carefully confirm destination wallet addresses before approval, as malware may tamper with them even when the UI appears valid. 
• Use hardware wallets for storing high-value assets to reduce exposure risk. 
• Monitor wallet activity regularly for signs of unauthorized or anomalous transfers. Encourage users to contact support immediately if suspicious activity is detected. Ensure the support team is trained to handle such calls, investigate possible malicious exploits, and guide users through mitigation steps. 
• Update affected client applications to patched versions to ensure malicious components are fully removed. 

Strategic & Organizational Recommendations For Crypto/Finance organizations

Strengthen Supply Chain Controls 

• Pin dependencies to verified versions and use ‘npm ci’ instead of ‘npm install’ to enforce lockfile consistency. While this strengthens supplychain integrity, it adds complexity for developers (slower iteration, lockfile conflicts, harder testing of new versions). Whether to enforce strict reproducibility should be decided based on each team’s risk appetite and operational needs. 
• Conduct security awareness training for developers to identify phishing and credential harvesting attempts. Include this case-study to demonstrate the risk. 
• Integrate automated dependency scanning tools (e.g., Snyk, Semgrep, Mend.io, Socket.dev) into CI/CD pipelines to flag malicious or anomalous packages early. 
• Mirror critical open-source packages in private registries and vet updates before internal distribution. 

Leverage Existing Security Tooling 

• Users of Checkmarx, Snyk, and similar tools should re-scan all projects to ensure clean dependency trees. 

Monitor for Indicators of Compromise (IoCs) 

• Review build and runtime logs for: 
• CI/CD build logs: Search for ‘ReferenceError: fetch is not defined’ between September 8–12, 2025. Treat any occurrences as high-confidence indicators and correlate with failed builds that may have installed compromised packages. 
• Dependency exposure: Scan lockfiles (package-lock.json, yarn.lock, pnpm-lock.yaml, bun.lockb) for the specific malicious versions listed in the appendix. Trigger alerts on matches and enforce build failures within CI pipelines. 
• Egress and DNS logs: Query DNS and proxy logs for the following domains between September 5–12, 2025: 
• npmjs[.]help 
• static-mw-host.b-cdn[.]net 
• img-data-backup.b-cdn[.]net 
• websocket-api2.publicvm[.]com 

Block and alert on any future connections to these domains. 

• Look for signs of credential or secret exfiltration, and unauthorized cryptocurrency transfers from corporate assets. 

If any indicators of compromise are found, immediately activate your organization’s incident response procedures. 

Sygnia’s Perspective

This npm supply chain attack highlights the inherent fragility of open-source ecosystems and the speed at which adversaries can weaponize trusted dependencies. By combining sophisticated phishing techniques with multi-layered malware, the attackers demonstrated that a single compromised maintainer account can introduce systemic risk to millions of users and enterprises worldwide. In Sygnia’s crypto related incidents, we have also observed compromises of developer, DevOps, and IT administrator accounts as initial access vectors. The common thread across these cases is adversary control over individuals who publish code, manage CI/CD pipelines, or administer infrastructure enabling malicious updates and code deployment to flow through trusted systems and dependencies. 

Several critical lessons emerge from this incident: 

• Maintainer compromise is a systemic risk: Even a single developer account can serve as an entry point into the global software supply chain. 
• Scale amplifies threat potential: With billions of weekly downloads, the attack’s blast radius extended from individual developers to enterprise environments. 
• Adversary capabilities are rapidly advancing: Techniques such as obfuscation, cross-chain cryptocurrency targeting, and fuzzy address replacement reflect a high degree of sophistication. 
• Front ends become payment rails: Compromised front-end interfaces such as wallets, exchanges, or DeFi applications can function as unauthorized payment rails, enabling theft without triggering clear anomalies on the backend. 
• Browser-based malware directly impacts end users: Malicious dependencies can bypass traditional enterprise defenses and compromise personal financial assets. 
• Early response can limit damage: Timely detection and containment helped prevent major financial losses, though the potential for greater harm was significant. 
• Proactive defense is essential: Dependency auditing, automated scanning, and continuous monitoring must be the baseline security practice. Recent advances include policy-driven SCA tools, reputation-based dependency scoring, and supply chain gateways that enforce software integrity at the CI/CD level across platforms such as GitHub, Jenkins, and Kubernetes. 

This incident demonstrates how quickly trusted code can be weaponized. For cryptocurrency-focused organizations, the consequences include immediate exposure of both assets and customers. Supply chain security must be treated as a board level priority, with a focus on identity hardening for maintainers, developers, DevOps engineers, and IT administrators alongside baseline controls that verify transaction integrity. 

Appendix 

Compromised npm Packages and Versions 

The following packages were confirmed to include malicious code on September 8, 2025. Only the versions listed below are known to be compromised. 

Color & Styling Utilities 

• [email protected] – Style and color terminal output (≈300M weekly downloads). 
• [email protected] – Template literal support for chalk (≈3.9M weekly). 
• [email protected] – ANSI escape codes for colors and styles (≈371M weekly). 
• [email protected] – Detect terminal color support (≈287M weekly). 
• [email protected] – Convert between RGB, HSL, HEX (≈193M weekly). 
• [email protected] – Parse CSS color strings (≈27M weekly). 
• [email protected] – CSS color name to RGB mappings (≈191M weekly). 
• [email protected] – General color conversion/manipulation. 

ANSI / Terminal String Handling

• [email protected] – Regex to match ANSI escape codes (≈243M weekly). 
• [email protected] – Remove ANSI codes from strings (≈261M weekly). 
• [email protected] – Slice strings safely with ANSI sequences (≈59M weekly). 
• [email protected] – Wrap text with ANSI sequences preserved (≈197M weekly). 
• [email protected] – Detect ANSI codes in strings (≈12M weekly). 

General Utilities 

• [email protected] – Normalize arguments into arrays (≈26M weekly). 
• [email protected] – Check if a value is array-like (≈73M weekly). 
• [email protected] – Normalize Windows path backslashes (≈0.26M weekly). 
• [email protected] – Create error objects with custom properties. 

Debugging & Logging 

• [email protected] – Namespace-based logging utility (≈357M weekly). 
• [email protected] – Detect terminal hyperlink support (≈19M weekly). 

Experimental / Miscellaneous 

• [email protected] – Prototype Web Components for testing. 
• @duckdb/[email protected], @duckdb/[email protected], [email protected], @duckdb/[email protected] – Database components. 
• [email protected], prebid-universal-creative, prebid@latest – Ad tech libraries. 

Attacker-Controlled Cryptocurrency Wallets 

Ethereum (ETH) 

• 0xFc4a4858bafef54D1b1d7697bfb5c52F4c166976 (primary) 
• 0xa29eeFb3f21Dc8FA8bce065Db4f4354AA683c024 
• 0x40C351B989113646bc4e9Dfe66AE66D24fE6Da7B 

Bitcoin (BTC) 

• 1H13VnQJKtT4HjD5ZFKaaiZEetMbG7nDHx 
• bc1qms4f8ys8c4z47h0q29nnmyekc9r74u5ypqw6wm 

Solana 

• 5VVyuV5K6c2gMq1zVeQUFAmo8shPZH28MJCVzccrsZG6 

Function Selectors Targeted (Ethereum) 

• 0x095ea7b3 – approve() 
• 0xa9059cbb – transfer() 
• 0x23b872dd – transferFrom() 
• 0xd505accf – permit() 

Malware Code Characteristics 

• Hooks into fetch(), XMLHttpRequest, and window.ethereum.request. 
• Environment checks for browser objects (typeof window !== ‘undefined’). 
• Levenshtein algorithm for wallet address substitution. 
• Hidden control object: window.stealthProxyControl. 

Phishing Infrastructure 

• Domain: npmjs[.]help 
• IP: 185.7.81.108 
• Email: support[at]npmjs[dot]help 
• Malicious CDN: static-mw-host.b-cdn[.]net, img-data-backup.b-cdn[.]net 
• Remote host: websocket-api2.publicvm[.]com 
• Example phishing URL: https://www.npmjs[.]help/settings/qix/tfa/manageTfa?action=setup-totp