NPM Supply Chain Attack: Developers Account Compromised, Malware Targets Crypto Wallets
A critical security incident has shaken the NPM (Node Package Manager) ecosystem. The account of prominent developer 'qix' was breached by attackers, who used it to push malicious updates to several widely-used JavaScript libraries. The malware actively scans users' devices for bitcoin and other cryptocurrency wallet files—such as private key stores, configuration files, or wallet databases. Once a target is identified, it replaces the underlying transaction signing function's address-filling logic, swapping the user's intended recipient address with one controlled by the attacker. Because the tampering occurs at the code execution layer, the front-end interface may still display the correct address, but the actual signed transaction sends funds to the attacker's wallet, resulting in direct theft.
Attack Mechanism: How It Bypasses User Perception
NPM is the standard package manager for Node.js, relied upon by millions of JavaScript applications, including countless non-cryptocurrency websites and tools. The attackers did not target crypto-specific libraries; instead, they compromised widely-used infrastructure-level packages. By gaining control over an upstream developer account, the hackers were able to poison the supply chain downstream—any application that integrated the infected dependency, whether a web wallet, dApp, or ordinary website, could execute the malicious logic at runtime. For browser-based or JavaScript runtime web wallets, the risk is particularly high because they often load backend code dynamically or update dependencies without the rigorous vetting of app store reviews. The attackers exploited this openness by disguising malware as a normal feature update.
Specifically, the malicious code intercepts API calls used to retrieve the recipient address during transaction signing. When a user enters an address and initiates a transfer, the code silently replaces the address with a pre-configured attacker address before proceeding with the signing flow. Since the replacement occurs at the memory level, the front-end display may also be simultaneously modified, making it nearly impossible for users to detect the anomaly visually.
Impact on Crypto Users: Focus on Ordinals/Runes Ecosystem
This attack primarily threatens bitcoin web wallet users, especially those active in ecosystems like Ordinals (for inscription) and Runes (for token trading). If the wallet software you use happened to update its dependencies shortly after the attack (including the compromised NPM packages), or if your wallet dynamically loads code directly from the backend bypassing the app store, you are at high risk. Ordinary native mobile app wallets (downloaded from official iOS or Android stores) are generally not immediately affected because their codebases are written in native languages (Swift, Kotlin, etc.) and do not directly depend on JavaScript runtimes. However, if you use a hardware wallet in combination with a web wallet (e.g., connecting a Ledger or Trezor via a browser extension), extra caution is required: before signing a transaction, carefully verify the destination address on the hardware device screen itself, as malware may have altered the address shown in the browser.
Furthermore, the attack's impact extends beyond cryptocurrency wallets—any JavaScript application that uses the compromised NPM packages could be backdoored, including e-commerce sites, social platforms, etc. But because the crypto sector involves direct asset transfers, the financial consequence is the most immediate and severe.
Security Recommendations: How to Protect and Respond
Based on the characteristics of this incident, different user groups should take the following targeted measures:
- Users of hardware wallet + web wallet: During transaction signing, always independently verify the recipient address on the hardware device screen. Do not trust the address shown in the browser or wallet interface alone. Since the hardware signing process is isolated from the computer, it can effectively block address tampering as long as the device itself is not compromised.
- Users of software keys (hot wallets): Immediately stop using the wallet and avoid any transactions until the official team releases a security advisory confirming that the current version is not affected. The safest course is to wait for a clear fix announcement or updated patch from the wallet development team.
- All web wallet users: Check the dependency list of your wallet or dApp for any known compromised NPM packages (specific package names will be disclosed by security teams). If you find that an affected dependency has been used, stop using the wallet immediately and transfer funds to an uncompromised address. Additionally, enable two-factor authentication (2FA) for added account security.
This incident serves as a stark reminder: the security of decentralized applications depends not only on smart contracts and consensus mechanisms but also on the underlying software development infrastructure. Supply chain attacks are becoming increasingly common, and users must maintain high vigilance and pay attention to early warnings from security agencies.