Supply chain attack targets npm, +2 Billion weekly npm downloads exposed

A supply chain attack hit npm, exposing the platform’s heavily used ecosystem after a maintainer fell for a phishing email designed to harvest 2FA credentials, with more than 2 billion weekly downloads impacted. The incident targeted Josh Junon, known on npm as Qix, in an account-access theft campaign that used an account-takeover approach to publish a malware-laced version of affected packages.

The phishing message, which mimicked npm support, urged updates to 2FA before 10 September 2025 and redirected recipients to a page collecting username, password and 2FA tokens. Aikido Security researchers found that attackers injected malicious code into index.js of the compromised packages, creating a browser-based interceptor that hijacks web traffic and wallet APIs, and rewrites transaction destinations to attacker-controlled addresses.

The attack affected 20 packages with over 2 billion weekly downloads, including popular names such as chalk, debug and ansi-styles, and Junon confirmed the incident and apologised for its impact, stating that only npm was affected. The firm also provided indicators of compromise and recommended verification of package versions, clearing npm cache, reinstalling dependencies and using lock files with pinned versions. Centre