Massive npm Supply Chain Attack: Qix’s Account Compromised, Billions of Weekly Downloads at Risk

Socket has detected a large-scale supply chain attack targeting the npm ecosystem, with the account of prolific maintainer Qix compromised and malicious versions of foundational JavaScript packages published, collectively receiving billions of downloads weekly. According to Socket, the compromised account enabled attackers to push malicious versions of widely used packages that generally receive 2–3 billion downloads per week.

At least 20 core packages were trojanised, including chalk@5.6.1, debug@4.4.2, ansi-styles@6.2.2, supports-color@10.2.1, and several others, with these libraries forming part of formatting, debugging and rendering in Node.js applications. The trojanisation widened the impact radius because many projects are co-maintained with Sindre Sorhus, the most popular npm maintainer by download count.

Qix confirmed the compromise via Bluesky, and phishing activity allegedly originated from a spoofed npm branding email aimed at convincing the maintainer to click a fake “Update 2FA Now” link. The malware payload can hijack crypto wallet addresses, hooks network requests, and even target DEX routers such as Uniswap and PancakeSwap. Socket urges users not to upgrade to compromised versions, to lock dependencies to safe releases, and to audit recent installs and CI/CD builds for signs of compromise.

According to Socket, these insights underscore how credible-looking 2FA reset emails can slip past even experienced maintainers and why phishing remains a favoured tactic for high-value account compromise in the open source ecosystem.