{"id":54483,"date":"2026-01-14T11:19:43","date_gmt":"2026-01-14T10:19:43","guid":{"rendered":"https:\/\/cyberant.com\/large-scale-attack-on-popular-npm-packages-millions-of-websites-and-apps-potentially-affected\/"},"modified":"2026-01-14T11:19:43","modified_gmt":"2026-01-14T10:19:43","slug":"large-scale-attack-on-popular-npm-packages-millions-of-websites-and-apps-potentially-affected","status":"publish","type":"post","link":"https:\/\/cyberant.com\/en\/large-scale-attack-on-popular-npm-packages-millions-of-websites-and-apps-potentially-affected\/","title":{"rendered":"Large-scale attack on popular npm packages: millions of websites and apps potentially affected"},"content":{"rendered":"

Several widely used npm-packages (software building blocks) have been infected with malicious code. This happened after a successful phishing attack on one of the administrators of these building blocks. An npm-package is a building block that developers can use in their software so they don’t have to reprogram frequently used components every time. As a result, building blocks end up everywhere: in custom software as well as in standard products. Together, the infected components are downloaded and used more than 2 billion times a week by developers worldwide. <\/p>\n

Phishing<\/h2>\n

The attackers gained access to the repository through a phishing email. The attack targeted Josh Junon (also known as Qix), a developer who is co-manager of several popular packages. Qix has the rights to add and approve new code, making his account sufficient to spread this malware. <\/p>\n

Junon received a phishing email that looked very much like it came from npm itself, telling him to renew his two-step authentication (2FA) via a link before Sept. 10, 2025. When he followed this link, he was taken to a fake website where he entered his username, password and 2FA code. This data was immediately intercepted by criminals through a so-called Adversary-in-the-Middle attack<\/em>, which allowed them to gain access to his account. With that access, the attackers were then able to publish infected versions of twenty popular packages in the official npm library. <\/p>\n

On BlueSky , Junon responded<\/a>, “Sorry everyone, I should have paid more attention. Not like me; have had a stressful week. Will work to get this cleaned up.”<\/p>\n

Which packages are affected?<\/h2>\n

Among others, the following NPM packages contain temporarily malicious code:<\/p>\n

    \n
  • \n

    chalk (widely used to display text in color in software tools)<\/p>\n<\/li>\n

  • \n

    debug (widely used for debugging)<\/p>\n<\/li>\n

  • \n

    ansi-regex, ansi-styles, wrap-ansi, strip-ansi (components that work with text formatting)<\/p>\n<\/li>\n

  • \n

    color-convert, color-string, color-name (for color management in software)<\/p>\n<\/li>\n<\/ul>\n

    Together, these packages account for two billion downloads per week. Because they are often reused as building blocks in other packages, the infection was able to spread widely. <\/p>\n

    Especially risk for crypo providers<\/h2>\n

    Analysis of the malware revealed that it was designed to steal cryptocurrency. The malicious code began by checking if it was running in a browser, then hooked into functions such as window.fetch<\/em>, XMLHttpRequest<\/em> and window.ethereum.request.<\/em> These are components that websites use to exchange data and control crypto-wallets. This allowed the code to imperceptibly replace the recipient’s wallet address with that of the attacker during a payment, with the forged address resembling the original and therefore barely noticeable. <\/p>\n

    This type of attack comes under the heading of software supply chain attack. A supply chain attack involves attacking not the end user directly, but a link in the software supply chain. Similar attacks have been seen before, for example through typosquatting (offering a package with a nearly the same name as a popular package) or through slopsquatting (capitalizing on mistakes made by AI systems that recommend incorrect package names). <\/p>\n

    In this case, the malware specifically targets developers offering crypto-related services, so most software is unlikely to be affected even if it is infected.<\/p>\n","protected":false},"excerpt":{"rendered":"

    Several widely used npm-packages (software building blocks) have been infected with malicious code. This happened after a successful phishing attack on one of the administrators of these building blocks. An npm-package is a building block that developers can use in their software so they don’t have to reprogram frequently used components every time. As a […]<\/p>\n","protected":false},"author":3,"featured_media":54364,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[223],"tags":[183,190,335,188],"class_list":["post-54483","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news-en","tag-cyberaanval-en","tag-datalekken-en","tag-supply-chain-attack","tag-vulnerability-management-en"],"_links":{"self":[{"href":"https:\/\/cyberant.com\/en\/wp-json\/wp\/v2\/posts\/54483","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cyberant.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cyberant.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cyberant.com\/en\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/cyberant.com\/en\/wp-json\/wp\/v2\/comments?post=54483"}],"version-history":[{"count":0,"href":"https:\/\/cyberant.com\/en\/wp-json\/wp\/v2\/posts\/54483\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cyberant.com\/en\/wp-json\/wp\/v2\/media\/54364"}],"wp:attachment":[{"href":"https:\/\/cyberant.com\/en\/wp-json\/wp\/v2\/media?parent=54483"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cyberant.com\/en\/wp-json\/wp\/v2\/categories?post=54483"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cyberant.com\/en\/wp-json\/wp\/v2\/tags?post=54483"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}