18 Popular Code Packages Hacked, Rigged to Steal Crypto

Krebs on Security reports that at least 18 popular JavaScript code packages, downloaded more than two billion times weekly, were briefly compromised after a developer was phished, allowing attackers to add malicious code to NPM packages.

The phishing involved a fake NPM login page used to harvest credentials and a one-time token for 2FA, after which the attackers changed the account email and injected code that silently intercepted cryptocurrency activity and manipulated wallet interactions to redirect funds to attacker-controlled accounts.

Akido said the attackers injected a browser-based interceptor that operates across multiple layers, including altering website content and API calls, with Charlie Eriksen describing the malware as capable of hijacking what users’ apps believe they are signing. The affected maintainer Josh Junon was notified, and Akido noted that the spoofed site npmjs[.]help was registered just two days before the phishing email, with dnsexit[.]com services used for dynamic DNS.

The piece also references a broader supply-chain risk and argues for stronger attestation and phish-proof 2FA, citing Nicholas Weaver of the International Computer Science Institute. This entry was posted on 8 September 2025.