NPM supply-chain attack hijacks maintainer account to push malware

A sophisticated supply chain attack on the npm JavaScript registry on September 8 saw attackers hijack a prominent maintainer's account and publish malicious updates to widely used packages, injecting browser malware that silently redirected cryptocurrency transactions to attacker controlled wallets. Security researchers detected the changes quickly, and many of the compromised packages were removed within hours, but the incident exposed major gaps in open source trust and left developers scrambling to audit dependencies.

Investigators said the campaign began when the account of Josh Junon, known as qix, was compromised after he clicked a phishing link and entered credentials and a one time authentication token on a counterfeit site that mimicked npm support. Junon acknowledged the takeover on social media, writing, "Yep, I've been pwned. 2FA reset email, looked very legitimate," and apologized for the breach. Researchers traced the phishing infrastructure to a typosquatted domain that impersonated npm and found a login form that exfiltrated credentials.

Security firm Aikido, which first flagged the incident, said attackers pushed malicious code into dozens of packages...