Attack Details: Account Hijacking and Malicious Package Propagation
An NPM developer account known as qix—a widely recognized contributor—was compromised by attackers. They used the account to push malicious dependency packages to several Node.js projects. The injected code specifically targets Bitcoin and cryptocurrency wallets: it scans the user's device for wallet-related files or processes, then patches the transaction signing functions to replace the destination address with an address controlled by the attacker. This substitution happens at the time of signing, making it invisible to the user unless verified on a separate trusted device.
NPM is the standard package manager for Node.js, a popular JavaScript runtime. The chosen packages were not cryptocurrency-specific; they were general-purpose libraries used by thousands of normal applications. This broadens the attack surface beyond crypto wallets, though the wallet-specific scanning logic only activates when wallet-related code is detected.
Affected Users: Web Wallets and Ordinals/Runes Users at Higher Risk
Users of web-based wallets—such as browser extensions or web portal wallets—face the greatest risk. If the wallet application or its dependencies were updated after the malicious packages were published, the malware becomes embedded in the wallet's runtime. For Bitcoin ecosystem token users (Ordinals, Runes, etc.), the risk is elevated because many of these tools rely on Node.js-based wallet interfaces. Hardware wallet users are less vulnerable because the transaction must be confirmed on the hardware device itself, which displays the real destination address. However, if the web wallet UI shows a manipulated address and the user blindly signs without checking the device, the attack could still succeed.
It is important to note that the attack does not discriminate by cryptocurrency; any wallet built on Node.js could be compromised. The malware searches broadly for wallet-related identifiers, including Bitcoin, Ethereum, and other blockchain wallets.
Security Recommendations: Verify on Hardware, Hold on Software Wallets
For users combining a hardware wallet with a web wallet: always verify the destination address on the hardware device's screen before signing. The hardware's independent display and signing mechanism cannot be tampered with by the malware on the host computer. If the address shown on the device differs from the one on the web interface, cancel the transaction immediately.
For users relying solely on software keys (private keys stored in the web wallet): do not open the wallet or initiate any transactions until you are certain that the wallet version you are running does not contain the malicious dependency. The safest approach is to wait for an official announcement from the wallet's development team confirming that the vulnerability has been patched. If your wallet was downloaded from an official app store and does not dynamically load backend code, the attack surface is smaller but not eliminated. Consider using a dedicated hardware wallet as a long-term security measure.