Crypto-steel malware infiltrates Kern JavaScript libraries used by millions

The NPM (Node Packet Manager) account of developer ‘Qix’ was compromised, allowing Hackers to publish malignant versions of his packages.

The attackers published malignant versions of dozens of extremely popular Javascript packages, including fundamental utilities. The hack was enormously designed, because the affected packages have more than 1 billion combined weekly downloads.

This attack on the software’s supply chain is specifically aimed at the ecosystem of Javascript/Node.js.

NPM Supply Chain Attack

Popular Dev Qix was the victim of phishing. Malignant code injected into NPM packages now hijacks crypto transactions when signing.

Attack method:
• Hooks wallet functions (request/shipping)
• Exchange receiver -addresses in ETH/Sol transactions
• Replaces … pic.twitter.com/jn9h4hwp8v

– SCAM Sniffer | Web3 Anti-Scam (@RealsCamsniffer) September 8, 2025

Crypto Clipper Malware

The malignant code was a “crypto-clipper” that was designed to steal cryptocurrency by exchanging wallet addresses in network requests and direct crypto transactions. It was also severely obscured to prevent detection.

The crypto-stealing malware has two attack vectors. If no crypto-wallet extension is found, the malware allows the network traffic to replace all the network traffic by the native fetch and HTTP application functions of the browser with extensive lists of the wallet addresses to attacker.

With the help of advanced address changes, the use of algorithms makes replacement addresses that look visually on legitimate, which makes fraud almost impossible to recognize with the naked eye, said Cyber ​​security researchers.

If a crypto wallet is found, the malware transactions intercepts before they sign, and when users initiate transactions, it changes them in memory to destroy funds to attacker addresses.

The attack was aimed at packages such as ‘Chalk’, ‘Strip-Anti’, ‘Color-Convert’ and ‘Color-Note’, those core building blocks that are deeply buried in the dependency trees of countless projects.

The attack was accidentally discovered when a build pipeline failed with a “fetch is not defined” error because the malware tried to exfil the data using the Fetch function.

“If you use a hardware wallet, pay attention to every transaction before you sign and you are safe. If you do not use a hardware wallet, you should not be done for the time being,” ” advised Ledger CEO Charles Guillemet.

Explanation of the current NPM -Hack

On every website that uses this hacked dependency, it gives the hacker the chance to inject malignant code, so for example when you click on a “Swap” button on a website, the code can replace the TX that has been sent to your wallet by a TX sending money to …

– 0xngmi (@0xngmi) September 8, 2025

Wide attack vector

Although the charge of the malware specifically focuses on cryptocurrency, the attack vector is much broader. It influences every environment with JavaScript/node.js applications, such as web applications that are performed in browsers, desktop applications, server-side Node.js applications and mobile apps using JavaScript-frameworks.

So a regular business web application can unconsciously record these malignant packages, but the malware would only activate if users have interaction with cryptocurrency on that site.

The UZZ and BlockLoyed blocked Were one of the first to reassure users that their systems were not at risk.

With regard to the reports of the NPM attack of the Supply Chain:

Uniswap -apps are not at risk

Our team has confirmed that we do not use vulnerable versions of the affected packages

As always, be vigilant

– Uniswap Labs (@youwap) September 8, 2025