Charles Guillemet, Chief Technology Officer at hardware wallet manufacturer Ledger, issued an urgent warning on Monday about a large-scale software supply chain attack targeting NPM packages within the JavaScript ecosystem. The attack, which has compromised a reputable developer’s NPM account, has introduced malicious code into popular packages that have been downloaded over 1 billion times, posing a significant risk to developers and cryptocurrency users worldwide.
Attack Vector: Silent Address Swapping
According to Guillemet’s posts on X, the injected malicious code is designed to silently replace cryptocurrency withdrawal addresses during on-chain transactions, rerouting funds to attacker-controlled wallets. This type of attack requires no user interaction and can evade standard security scans. Guillemet described it as a “potentially all chains” threat, emphasizing that the entire JavaScript ecosystem may be at risk.
Risk Advisory: Software Wallet Users Should Refrain from Transacting
Guillemet strongly advised users who do not use a hardware wallet to temporarily abstain from any on-chain transactions until the supply chain attack is contained. For users of Ledger or other hardware wallets that support “Clear Signing” functionality, he noted that the risk is low because these devices display transaction details on a secure screen, allowing users to manually verify the recipient address before signing. However, it remains unclear whether the attacker has also stolen seed phrases from software wallets.
Incident Background: Compromised Developer Account
The incident began when a well-known developer’s NPM account was hacked. The attacker used the compromised account to publish malicious versions of several widely used JavaScript packages. Multiple security teams have confirmed that this is one of the largest NPM supply chain attacks to date, with the full impact still under assessment.
Security Recommendations: Vigilance and Double Verification
Guillemet and various security organizations have issued the following recommendations: immediately check the integrity of local NPM packages; use tools to scan project dependencies for suspicious code; for cryptocurrency users, carefully verify the recipient address character by character before signing any transaction, and prioritize hardware wallets with clear signing capabilities. Developers should also enable two-factor authentication on their NPM accounts and avoid using weak or reused passwords.
This event once again highlights the critical importance of software supply chain security. As the crypto ecosystem becomes increasingly intertwined with the JavaScript ecosystem, a single package contamination can trigger a chain reaction. Industry voices are calling on NPM to strengthen account security audits and promote code signing verification mechanisms. The list of affected packages is being continuously updated, and users are urged to monitor official security advisories closely.