A large-scale supply‑chain incident hit the JavaScript ecosystem on September 8, 2025, after a popular maintainer’s npm account was phished and used to publish malicious updates to 18 high‑fan‑out packages, including chalk and debug. The injected code acted as a cryptostealer when bundled into browser apps, with logic to observe wallet interactions and silently swap destination addresses. Early community triage and platform takedowns prevented widespread loss.
Primary discovery and technical analysis surfaced within hours from JD Staerk and security teams at Aikido Security and Semgrep. Ledger’s CTO amplified the alert and later signaled containment on X (see the updates here and here).
Investigators attribute the compromise to targeted phishing against the maintainer. A fake support domain impersonating npm support prompted credential capture and session takeover. With valid publish rights, the attacker pushed trojanized versions that looked legitimate at a glance but contained obfuscated payloads designed to activate in the browser (e.g., gated behind typeof window !== 'undefined'). Once downstream apps rebuilt, the tainted code could observe approvals and rewrite recipient addresses for ETH, BTC, SOL and other chains.
Keep tables link‑free.
| Package | Malicious version |
|---|---|
| chalk | 5.6.1 |
| debug | 4.4.2 |
| ansi-styles | 6.2.2 |
| strip-ansi | 7.1.1 |
| ansi-regex | 6.2.1 |
| supports-color | 10.2.1 |
| wrap-ansi | 9.0.1 |
| slice-ansi | 7.1.1 |
| color | 5.0.1 |
| color-convert | 3.1.1 |
| color-string | 2.1.1 |
| color-name | 2.0.1 |
| is-arrayish | 0.3.3 |
| simple-swizzle | 0.2.3 |
| supports-hyperlinks | 4.1.1 |
| has-ansi | 6.0.1 |
| chalk-template | 1.1.1 |
| backslash | 0.2.1 |
These utilities sit deep in dependency trees and are routinely bundled into dApp front‑ends, exchange dashboards, token launchpads, and wallet‑connected websites. If the tainted releases had propagated for days, users could have seen addresses swapped or approvals abused across major chains without any changes in the visible UI. Because the payload executed only in browser contexts, server‑side tests were unlikely to catch it; the risk window was tied to client‑side builds and CDN caches.
debug and chalk issues) and confirmed resolution.package-lock.json/yarn.lock) for the versions above; repin to known‑good releases and reinstall from scratch.One developer’s credentials became leverage against millions of apps. The lesson is simple: phishing‑resistant MFA, reproducible builds with locked dependencies, and fast cache‑purge workflows are mandatory controls when your packages ship everywhere. The ecosystem dodged a worst‑case, front‑end wallet drain because response was coordinated and fast.
Primary sources: JD Staerk, Aikido Security, Semgrep, Vercel. Signals & updates: Ledger CTO on X and the resolution note.
The post Malicious npm Release Attempted to Hijack Wallets – Quick Response Averted Disaster appeared first on Crypto Adventure.
Also read: Binance Ignites a Price Explosion for 2 Altcoins: Details Here