Highly Popular NPM Packages Poisoned in New Supply Chain Attack

SecurityWeek reports that malicious actors poisoned 18 NPM packages maintained by Josh Junon (Qix) after he was phished into giving up his account, with the attack designed to intercept cryptocurrency transactions. The attackers used phishing emails from support npmjs help, directing victims to a spoofed npmjs[.]help domain to pressure updating 2FA credentials, and some recipients reported the site while others were compromised.

The compromised code, injected into the packages, functions as a browser-based interceptor that can alter content, intercept API calls, and swap payment details with attacker-controlled values, potentially affecting frontend builds, web assets, and some CI/CD workflows, according to Wiz and security firm Aikido.

The attack involved 18 NPM packages, collectively with over 2.5 billion weekly downloads, and researchers noted the malicious versions circulated for about two hours during which time the payload could reach cloud environments, with Wiz stating it reached at least 10% of cloud environments. GitHub advisory urged immediate rotation of secrets and removal of the poisoned packages, as full compromise could persist beyond removal.