In a significant security breach, several popular npm packages such as ‘debug’ and ‘chalk’ have been compromised with malicious code targeting cryptocurrency transactions. This incident involved 18 npm packages cumulatively accounting for billions of weekly downloads.
The attack began when a developer, known as Qix, fell victim to a phishing email that specifically crafted to capture their credentials. This led to unauthorized access to their npm account, allowing attackers to publish malicious versions of widely trusted packages. Among those affected were not only ‘chalk’ but also ‘color-convert’, ‘strip-ansi’, and ‘chalk-template’, among others.
The compromised packages contain malware that operates as a browser-based interceptor. It hooks into network functions and wallet APIs, silently manipulating cryptocurrency transactions by intercepting wallet interactions. Through this mechanism, payment destinations are altered, potentially redirecting funds to accounts controlled by the attackers. However, reports indicate that so far no funds have been reported stolen.
This attack is regarded as the largest software supply chain compromise in npm’s history, emphasizing the inherent vulnerabilities within package maintainer accounts. The deployed malicious payload aims at crypto websites in browsers rather than server environments. For the attack to be effective, it required users and developers to upgrade dependencies, deploy affected packages to frontend applications in production, and for transactions to be initiated by end-users.
In response to the breach, developers like Sindre Sorhus quickly republished packages such as chalk, removing the malicious code to mitigate ongoing harm. This event underscores the critical need for robust security practices, including vigilant monitoring of unusual account activities and ensuring that package updates are thoroughly vetted before being deployed in production.

Collections

A major security breach compromised 18 popular npm packages including debug and chalk through a phishing attack on maintainer credentials. The malicious code targeted cryptocurrency transactions by intercepting wallet interactions in browsers, though no funds were reportedly stolen. This represents the largest supply chain attack in npm's history, affecting packages with billions of weekly downloads.

Compromise of npm Packages Highlights Supply Chain Vulnerabilities

In <a href="https://www.bleepingcomputer.com/news/security/hackers-hijack-npm-packages-with-2-billion-weekly-downloads-in-supply-chain-attack/" target="_blank" rel="noopener nofollow">this article on Bleeping Computer</a> (and <a href="https://jdstaerk.substack.com/p/we-just-found-malicious-code-in-the" target="_blank" rel="noopener nofollow">here</a>), they also mention error-ex among the affected packages (not listed in every article on the topic).
EDIT: I just received a list via my company’s internal communication that is a bit longer:
<ul>
<li>ansi-regex@6.2.1</li>
<li>ansi-styles@6.2.2</li>
<li>backslash@0.2.1</li>
<li>chalk@5.6.1</li>
<li>chalk-template@1.1.1</li>
<li>color@5.0.1</li>
<li>color-convert@3.1.1</li>
<li>color-name@2.0.1</li>
<li>color-string@2.1.1</li>
<li>debug@4.4.2</li>
<li>duckdb@1.3.3</li>
<li>@duckdb/node-api@1.3.3</li>
<li>@duckdb/node-bindings@1.3.3</li>
<li>error-ex@1.3.3</li>
<li>has-ansi@6.0.1</li>
<li>is-arrayish@0.3.3</li>
<li>proto-tinker-wc@1.8.7</li>
<li>simple-swizzle@0.2.3</li>
<li>slice-ansi@7.1.1</li>
<li>strip-ansi@7.1.1</li>
<li>supports-color@10.2.1</li>
<li>supports-hyperlinks@4.1.1</li>
<li>wrap-ansi@9.0.1</li>
</ul>
(Source: <a href="https://www.mend.io/blog/npm-supply-chain-attack-infiltrates-popular-packages/" target="_blank" rel="noopener nofollow">https://www.mend.io/blog/npm-supply-chain-attack-infiltrates-popular-packages/</a>)

Just curious, what are the tools, channels or methods you guys are using to keep updated with any new package vulnerabilities?