Ledger Chief Technology Officer Charles Guillemet issued a stark warning on Monday about a large-scale software supply chain attack targeting NPM packages within the global JavaScript ecosystem. In a post on X, Guillemet revealed that a reputable developer's NPM account had been compromised, with affected packages downloaded over 1 billion times, raising serious concerns about asset exposure for developers and end users alike.
‘Potentially All Chains’ at Risk
“There’s a large-scale supply chain attack in progress … the entire JavaScript ecosystem may be at risk,” Guillemet wrote. He detailed that the malicious code “silently swaps crypto addresses on the fly to steal funds.” This means that even if a user copies a correct receiving address from a website, the malware can replace it with an attacker-controlled address just before the transaction is submitted.
Guillemet advised those not using a hardware wallet to refrain from making onchain transactions for now, and urged all users to review transaction details before signing. “For users of Ledger or other hardware wallets with clear signing, you are not at risk,” he emphasized, noting that clear signing and manual verification effectively protect against address-swapping malware.
Separate security outlets also reported ongoing NPM account compromises affecting widely used packages, with some describing the campaign as one of the largest of its kind to date. Guillemet said the impact could span “potentially all chains,” meaning any blockchain — Bitcoin, Ethereum, or others — could be affected if the frontend relies on compromised NPM packages.
Attack Mechanics and Mitigation Steps
According to security researchers, the attack began with the compromise of a well-known developer’s NPM account through social engineering or a vulnerability. Malicious code was then injected into popular packages, designed to activate only under specific conditions — such as detecting a cryptocurrency address input field on a webpage — thereby bypassing standard code review processes.
Ledger issued an official statement reiterating that the hardware wallet’s “clear signing” feature is a critical defense: the user sees the transaction content independently verified on the device, not the potentially tampered address displayed on the webpage. “It remains unclear whether the attacker has successfully stolen seed phrases from software wallets,” Guillemet added, “but all users relying on browser-based or desktop software wallets should maintain the highest level of vigilance.”
The security community recommends that developers immediately audit their project dependencies for package integrity, use lock files to pin versions, and consider enabling NPM package signature verification. General users should upgrade to the latest browser and wallet plugin versions, and make it a habit to double-check receiving addresses on their hardware device before signing any transaction.