npm attack alters packages like chalk and debug to swap wallet addresses: what happened and how to protect yourself

São Paulo, September 16, 2025 — On Monday, September 8, developers around the world received a warning: new versions of packages so basic that almost every JavaScript project uses them, such as chalk and debug, had been published with malicious code. The goal was not to steal passwords or take down servers. It was simpler and more dangerous for anyone dealing with crypto: swapping, in the browser, the wallet address where the user intended to send money.

Compromised packages from the maintainer, according to Aikido Security; counting other projects, Wiz listed 24 on 9/9

18

Combined weekly downloads of the affected packages

2 bn+

Time the malicious versions were available, according to Wiz

~2 h

Networks whose addresses the code tried to swap: Ethereum, Bitcoin, Solana, TRON, Litecoin and Bitcoin Cash

6

What happened

npm is the public repository of JavaScript packages. Website and app projects pull ready-made libraries from it and, with them, the libraries those depend on. This creates a supply chain: whoever breaks into a small, popular piece reaches thousands of programs without touching them.

The maintainer Josh Junon, known as Qix, received a phishing email imitating npm support, sent from a look-alike domain (npmjs.help) registered three days earlier, on September 5. By following the link and entering his credentials and the two-factor authentication code, he handed over control of the account. The attackers published new versions of 18 packages, including chalk 5.6.1, debug 4.4.2, ansi-styles, strip-ansi and color-convert. The security firm Aikido flagged the versions at 13:16 UTC (10:16 in Brasília), and the maintainer confirmed the intrusion about two hours later. The next day, JFrog and Wiz reported that the same campaign had also hit packages from DuckDB, a different project.

1. 09/05/2025Registration of the phishing domain imitating npm support.
2. 09/08, around 13:00 UTCThe maintainer's account is taken over and malicious versions of the packages are published.
3. 09/08, 13:16 UTCAikido flags the tampered versions.
4. 09/08, 15:15 UTCThe maintainer confirms the intrusion and starts cleanup; the versions were available for about two hours, according to Wiz.
5. 09/09/2025JFrog and Wiz report that the campaign also hit DuckDB packages; security firms publish lists of indicators.

How the code swapped the addresses

The code only acted in browsers, when a page that used the packages was open. It hooked into functions that the site uses to talk to the network and to the wallet, and altered the data along the way.

The similarity is the central point. Someone who checks only the beginning and end of the address can be fooled by an address chosen precisely because its start and end look alike. It is the same logic as address poisoning, but applied inside the software rather than in the wallet's history.

How much the criminals took

Little, according to early reports. Wiz, citing researchers' posts on social media, described the gain as “minimal,” and there is no consolidated figure from a primary source. Two factors help explain it: the versions were up for about two hours, and the code only affected pages of applications that updated the dependency and were published in that window, many of them with no crypto payment flow at all.

How to protect yourself when paying in crypto

For developers, the rules are: pin versions with a lock file (package-lock.json), install with npm ci, wait a few days before adopting newly published versions, and protect publishing accounts with physical security keys, which cannot be handed over on a fake site the way a typed code can. For those who only pay, the principle is different: the computer screen is not proof of the address. It was the same lesson as the Bybit attack, in which the screen showed the right destination and the signature authorized another.

1. Check the address on the wallet device (hardware wallet or phone app), not on the website or the browser extension.
2. Compare the entire address, character by character, with the one the supplier gave through a channel outside the computer, such as a call to an already known phone number.
3. On the TRON network, the TRC-20 address starts with T and has 34 characters; see how to read it in what the TRON network is.

Checking outside the computer works because it breaks the dependence on the same machine. A tampered browser can show a swapped address equally on the website, in the email opened in webmail and on the confirmation screen, but it does not alter the message sent by phone or what appears on the wallet device. The test transfer, the list of approved wallets and dual approval complete the routine and are covered in the guide on address poisoning.

What the episode shows

The case reinforces a pattern seen in 2025: the weakest link tends to be a person or a credential, not the cryptography. A convincing email to a single person was enough to reach libraries present in countless projects. The response involved maintainers, security firms and npm itself, and the versions came down in about two hours, but the final check of the destination remains the responsibility of whoever sends the money.

• Hacks
• Wallets
• Cybersecurity
• Social engineering
• Scams
• TRON
• USDT