New Email Security Technique Prevents Phishing Attacks Behind NPM Breach

The discovery of a large-scale NPM ecosystem compromise in September 2025 saw threat actors target developers with a sophisticated phishing campaign, impersonating NPM Support and sending a message titled “Two-Factor Authentication Update Required” to Josh Junon (known as “qix”) and other developers.

The attackers gained access to multiple developer accounts and modified 20 popular NPM packages by inserting a JavaScript clipper that could monitor activity and divert cryptocurrency transfers from wallets including BTC, ETH, SOL, TRX, LTC, and BCH. Following swift remediation, the compromised packages were reverted to clean versions and the affected developers regained control.

According to Group-IB, BEP’s detection capabilities could have intercepted the very first malicious message and blocked the campaign before it reached inboxes, even though SPF, DKIM and DMARC were in place. The incident involved nearly 2.8 billion weekly downloads across the affected packages, highlighting the potential impact of supply chain phishing on software ecosystems. It also emphasises the importance of multi-layered email security that combines authentication checks with behavioural analysis and threat intelligence.