20 Popular npm Packages With 2 Billion Weekly Downloads Compromised in Supply Chain Attack

A supply chain attack compromised 20 popular npm packages that together attract over 2 billion weekly downloads, after a maintainer’s account was phished and the attacker targeted the co-maintainer Josh Junon, known as Qix. The incident began when Junon received a message masquerading as npm support urging him to update his 2FA credentials before September 10, 2025, with the phishing page reportedly stealing username, password and 2FA token via an adversary‑in‑the‑middle method.

The rogue version of the packages was then published to the npm registry, according to the report. An analysis described the obfuscated malware as designed to intercept cryptocurrency transaction requests and swap destination wallet addresses, with payloads acting as a browser‑based interceptor that can hijack wallet APIs. The piece also cites ReversingLabs’ 2025 Software Supply Chain Security Report, according to which 14 of the 23 crypto‑related malicious campaigns in 2024 targeted npm.

The article notes that attackers have used typosquatting and slopsquatting to push malicious payloads, and warns that similarly exposed packages can enable theft of secrets and backdoors in organisations.