Hackers Hijack 18 Popular npm Packages Downloaded Over 2 Billion Times Weekly

Hackers hijacked 18 extremely popular npm packages, downloaded more than 2 billion times every week, injecting them with malware that targets cryptocurrency users and developers. Early on 8 September, a security feed flagged the sudden update of 18 packages—including chalk, debug, chalk-template, and supports-color—with malicious code, according to a report by Aikio.

The attackers injected malware that hooks critical browser APIs such as fetch and XMLHttpRequest, and wallet interfaces like window.ethereum and Solana, enabling them to scan traffic for cryptocurrency addresses and payments. When users interact with their wallets, the malware silently swaps the legitimate destination for an attacker-controlled address and can alter transaction signing to route assets to the attacker.

The initial infection vector was traced to a phishing email sent from a domain made to look like official npm support, tricking the maintainer into handing over credentials, with some maintainers subsequently compromised. Packaged updates continued, and a few like simple-swizzle remained infected for hours after the breach, illustrating the scale of the supply-chain risk.

Weekly download figures cited for affected packages include chalk 299.99m, debug 357.6m, ansi-styles 371.41m and strip-ansi 261.17m, all listed as compromised.