CyberDudeBivash Threat Analysis Report NPM Supply-Chain Phishing Attack

Executive Summary

On September 8, 2025, a sophisticated phishing campaign targeting npm maintainer “qix” led to the compromise of at least 18 widely used JavaScript packages, collectively receiving over 2 billion weekly downloads. Attackers injected crypto-stealing malware that hijacked transactions by modifying wallet addresses silently. The breach is now recognized as the largest NPM ecosystem supply-chain attack to date, though financial losses were surprisingly minimal—estimated at under $20 USD. Security Boulevard WebProNews Tom’s Hardware CCN CoinDesk Coinfomania BleepingComputer The Hacker News Socket Orca Security OX Security Sisa InfoSec Security Affairs

Attack Timeline & Methodology

Initial Vector: A phishing email impersonating npm (from npmjs.help) urged the maintainer to update 2FA, threatening account lockout by September 10. Security Boulevard BleepingComputer Socket The Hacker News
Execution: Within hours, attackers published malicious versions of core packages—e.g., chalk, debug, ansi-styles, strip-ansi, among others—totaling 18 packages. WebProNews The Hacker News Socket solomonh.substack.com Sisa InfoSec BleepingComputer
Payload Behavior: The inserted malware hooked browser APIs (fetch, XMLHttpRequest, window.ethereum, etc.) to intercept and replace crypto wallet addresses with attacker-controlled ones using a nearest-string (Levenshtein-distance) technique. CCN The Hacker News Checkmarx BleepingComputer Sisa InfoSec CoinDesk
Duration & Impact: The malicious releases remained active for just ~2–2.5 hours before detection and takedown. Surprisingly, financial theft amounted to only ~$0.05 in ETH and ~$20 in memecoin. Dark Reading Security Alliance CoinDesk Coinfomania BleepingComputer Security Affairs

Affected Packages Snapshot

Security sources confirm these amongst the compromised list (partial):

chalk (v5.6.1), debug (v4.4.2)
ansi-styles, strip-ansi, supports-color, wrap-ansi
Others: chalk-template, color-convert, color-string, error-ex, has-ansi, is-arrayish, slice-ansi, supports-hyperlinks, proto-tinker-wc, backslash Socket The Hacker News Sisa InfoSec Security Boulevard WebProNews Security Affairs Coinfomania Endor Labs

Threat Context & Implications

Broad Impact Potential: Given the ubiquity of the compromised packages in tooling and production code, downstream infection could have escalated quickly had detection lagged. Socket NowSecure Endor Labs Sisa InfoSec
Human-Centric Attack: The compromise relied solely on phishing—not software vulnerabilities—highlighting the power of social engineering in supply-chain threats. CodeAnt AI Snyk The Hacker News
Detection Averted Mass Damage: Rapid identification limited both technical and monetary harm—signals the importance of active monitoring and anomaly detection across package ecosystems. CCN Dark Reading CoinDesk Security Boulevard

Indicators of Compromise (IoCs)

Highlighted by Security Alliance and others for remediation:

Malicious domains and infrastructure:
- npmjs.help (phishing domain)
- static-mw-host.b-cdn.net
- img-data-backup.b-cdn.net
- websocket-api2.publicvm.com
- Attacker wallet addresses (e.g., 1H13VnQJKtT4HjD5ZFKaaiZ…, among hundreds) Security Alliance
Intrusion signatures and code patterns:
- Infected versions (2–2.5 hours) of packages in developer caches (node_modules) with crypto-clipper behavior. Search for checkethereumw in local install trees. Security Alliance Sisa InfoSec

Defense & Mitigation Recommendations

Scan Dependencies Immediately
- Use scripts like grep -R 'checkethereumw' across node_modules.
- Validate package integrity via Snyk, Aikido Security, Endor Labs, etc. Security Alliance Snyk Endor Labs
Harden Maintainer Security
- Enforce hardware-based 2FA, phishing-resistant tokens.
- Educate maintainers on fake domains (npmjs.help) and urgent phishing ploys. Snyk Socket The Hacker News
Adopt Supply-Chain Monitoring Tools
- Leverage SBOMs, provenance tracking, restricted dependency policies.
- Flag any unexpected package updates or new versions. Snyk NowSecure Sisa InfoSec
Audit at Runtime
- Monitor browser API hooks, transaction interception patterns.
- Validate wallet transactions before execution—small errors may reveal compromised code. CCN CoinDesk Coinfomania
Content and Dependency Pinning (With Caution)
- Popular practice but naïve; may still leave you exposed in deep dependency chains. Collective pinning strategies may offer better protection. arXiv

Incident At-a-Glance Table

Aspect	Details
Target	npm maintainer “qix” via phishing email from `npmjs.help`
Compromise	18 core npm packages injected with crypto-stealing payloads
Duration	~2–2.5 hours before removal detected and taken down
Financial Loss	Minimal (~$0.05 ETH + $20 memecoin)
Primary Threat	Supply-chain compromise affecting massive install base (~2B/week)
Key Defense	Swift detection, maintainer security, dependency scanning, runtime checks

CyberDudeBivash Verdict

A close call turned manageable, thanks to rapid detection. But let’s be clear—this incident exposes how fragile open-source trust ecosystems are. Just one convincing phishing email compromised billions of trusted downloads. The line between trusted utility and active threat can be razor-thin.

Keep supply chains locked down. Confirm every update. Trust, but always verify.

Author: CyberDudeBivash
Powered by: CyberDudeBivash Cyber Lab
Reach out for incident response, supply-frame audits, or hardened CI pipelines at iambivash@cyberdudebivash.com
#CyberDudeBivash #NPM #SupplyChainAttack #ThreatIntel #Phishing #CryptoClipper #CyberSecurity

Cyberdudebivash