A Billion-Download Supply Chain Attack That Ended With $1,050

A single phishing email briefly turned some of JavaScript's most-used building blocks into crypto-stealing malware — and still left the people behind it almost empty-handed.

At 13:16 UTC on September 8, 2025, maintainer Josh Junon — known on npm as "qix" — followed a link in what looked like a routine 2FA-reset notice. The sender's domain was npmjs.help rather than npmjs.com, a detail easy to miss on a tired morning. Junon later described the circumstances as the tail end of "a long week and a panicky morning" in comments posted to Hacker News. The attackers had registered the lookalike domain three days earlier, on September 5, and built the message around a manufactured deadline warning that accounts with outdated 2FA credentials would be locked starting September 10, 2025.

Junon maintains roughly 80 npm packages, among them some of the ecosystem's most deeply embedded dependencies: chalk (terminal text coloring), debug (logging), ansi-styles, strip-ansi, and color-convert. None of these are crypto-related tools — they're plumbing that sits quietly inside countless other projects' dependency trees. Chalk alone accounts for roughly 300 million weekly downloads, and debug adds another 358 million. Once the attackers had Junon's credentials, they pushed malicious updates to 18 packages with a combined 2-billion-plus weekly download count, making it, by download volume, one of the widest-reaching software supply chain compromises on record.

01A wallet-draining payload built for the wrong environment

The injected code was a browser-based crypto "clipper" — malware engineered to intercept and redirect cryptocurrency transactions. Its logic, obfuscated with variable-name mangling and flattened control flow, first checked for the presence of window.ethereum. Where that object existed, it hooked the request, send, and sendAsync methods, and separately overwrote fetch along with XMLHttpRequest.prototype.open and .send.

With those hooks in place, Ethereum calls to approve, permit, transfer, and transferFrom had their destination address silently swapped for one under attacker control. Solana transactions had their recipient, destination, and account keys rewritten to the string 19111111111111111111111111111111. For general network traffic passed through fetch or XMLHttpRequest, the malware scanned JSON responses for address-like substrings and swapped in one of roughly 280 hardcoded attacker addresses — selected by Levenshtein-distance matching so the replacement looked visually close to the original (turning, for example, a payment intended for 1BijzJvYU2GaBCYHa8Hf3PnJh6mjEd92UP into one sent to 1BBAQm4DL78JtRdJGEfzDBT2PBkGyvzf4N).

Had this run inside a browser session with a connected wallet, the design was capable of doing real damage. But npm packages execute in build pipelines and servers, not in browsers where wallet extensions live. Worse for the attackers, the code never checked whether fetch even existed before trying to override it — which threw errors the moment it ran inside typical CI/CD environments, immediately signaling that something was wrong.

02Five minutes to detection, two hours to contain

Aikido Security's monitoring flagged the anomaly about five minutes after the compromised packages went live, and within about an hour, Aikido co-founder Charlie was pushing warnings through security channels. By 15:15 UTC, Junon was attempting to pull the malicious releases — complicated by the fact that the attackers had also locked him out of his own account. One package, simple-swizzle, stayed compromised noticeably longer than the rest before it could be cleaned up.

Junon was candid about what happened, posting to Hacker News: "Hi, yep I got pwned. Sorry everyone, very embarrassing." That openness, combined with the malware's self-defeating CI/CD errors, helped the developer community mobilize quickly — sharing grep commands to detect infected installs and auditing dependency trees en masse within hours. The compromised packages were live on the registry for roughly two hours in total before cleanup was substantially complete, though any build that resolved dependencies during that window could theoretically have pulled the tainted code. Despite the scale of exposure, investigators have not identified confirmed victims of stolen funds.

03Following the money — to about $1,050

Tracking by researcher Rani Haddad traced the proceeds to a wallet holding roughly $1,050 — an amount that Arkham Intelligence itself lists under an unverified "custom" label. Security researcher Tayvano cross-checked a cloned version of the wallet, finding no TRON-chain activity and further supporting the attribution to the same attackers. Ledger CTO Charles Guillemet summarized the outcome as: "The attack fortunately failed, with almost no victims."

Set against that four-figure haul is the resource drain on the other side: security teams across the industry spent collectively enormous amounts of time auditing builds, patching pipelines, and issuing advisories, and maintainers broadly rushed to enable stronger 2FA protections. The incident's ripple effects reached into millions of downstream projects, and SEAL's write-up noted the episode will likely translate into new security-vendor sales well beyond what the attackers actually stole.

04What the near-miss changed

The incident renewed attention on tooling meant to stop exactly this kind of runtime tampering. Security researcher Tayvano pointed to Lavamoat, a free, open-source hardening tool built specifically to block malicious packages from monkey-patching globals like XMLHttpRequest, fetch, or window.ethereum at runtime — protection that, had it been in place downstream, would have neutralized this payload regardless of what happened at the source.

Developers were also pushed toward more defensive dependency hygiene: pinning exact versions in package.json, clearing and rebuilding node_modules, and regenerating lockfiles rather than trusting cached installs. On the wallet side, Guillemet's warning that users are "one code execution away from losing everything" reinforced the case for hardware wallets with clear-signing features that require manual verification of transaction details before approval — a habit that would have blunted this exact style of address-swapping attack.

Ultimately, the episode is notable less for what was stolen than for the mismatch between effort and outcome. Attackers compromised infrastructure touching a large share of the JavaScript ecosystem and deployed malware theoretically capable of draining wallets at scale, as summarized by the SEAL Alliance — yet the entire operation appears to have netted around $1,000, undone by a payload that targeted server environments where crypto wallets don't run, and exposed almost immediately by its own compatibility bugs.