Software packages with more than 2 billion weekly downloads hit in supply-chain attack

Hackers planted malicious code in open source software packages with more than 2 billion weekly downloads, in what is likely the world’s biggest supply-chain attack. The incident compromised nearly two dozen packages hosted on the npm repository, with the compromised maintainers pushing updates that added malicious code within an hour.

The updates enabled transfers of cryptocurrency to attacker‑controlled wallets, and the malware monitored for transactions involving multiple currencies before replacing destination addresses. According to Akido, the malicious code injects itself into infected systems’ web browsers and hooks JavaScript functions to exfiltrate tokens and other secrets, while a separate wave of supply‑chain attacks targeted PyPI, npm, DockerHUB, GitHub, Cloudflare and Amazon Web Services.

The overall attack is being described as a broad and high‑profile blight, and patterns similar to the npm compromise have also been seen in other open‑source ecosystems, including GitHub Actions workflows and token disclosures.