Crypto-stealing malware injected into major npm packages
Major npm JavaScript packages, including debug and chalk, were hacked and injected with malware designed to steal crypto assets. The supply chain attack was triggered by a phishing email and affected packages with billions of downloads. Counts of compromised packages differ, at 18 or 19.
Key facts
- Affected organisation
- Being confirmed
- Incident type
- Malware
- Occurred / detected
- Not confirmed
- Scale of damage
- Malware injected into 18 to 19 major npm packages
- Cause / method
- Supply chain attack on npm packages via a phishing email
- Location
- Other countries
Timeline
- It came to light that 18 to 19 major npm packages had been compromised and injected with crypto-stealing malware.
- The compromise of debug and chalk and the attack method using a phishing email came to light.
7 related reports
- 18 Popular Code Packages Hacked, Rigged to Steal Crypto
- 19 npm Packages Compromised in Major Supply-Chain Attack
- Massive npm hack poisons 18 packages with billions of downloads
- npm debug와 chalk 패키지 해킹 사고
- Crypto wallets targeted in widespread hack of npm, GitHub | RL Blog
- 18 popular JavaScript code packages hacked to spread malware
- JavaScript packages with billions of downloads were injected with malicious code in world's largest supply chain hack, geared to steal crypto — a phishing email is all it took to undermine npm packages
The summary and key facts are written by AI from related reports and may contain errors. Check the original articles and the organisation’s official statements for accurate details.