Huge NPM Supply-Chain Attack Goes Out With Whimper

On 8 September 2025, threat actors compromised the NPM account of Qix through a phishing attack and published poisoned versions of 18 open-source packages that together account for more than 2 billion weekly downloads. The malware was crypto-stealing and, for about two hours, all new downloads contained it, before the maintainer shut down the infected versions.

While some fear of a Log4j-style incident existed, experts suggest the potential impact was far smaller, with later notes that other packages may have been infected but the overall fallout remains limited for now.

In a thread, according to JFrog Security, observations suggested the attacker’s financial gain was modest, with claims of around 5 cents of Etherium and 20 USD of a memecoin, and the broader impact being the time spent cleaning compromised environments and potential downstream consequences for downstream users. Security researchers emphasise the need for robust supply-chain defence, vetting dependencies, and blocking affected package versions to prevent similar incidents in future.