Dev snared in crypto phishing net, 18 npm packages compromised

Crims have added backdoors to at least 18 npm packages after developer Josh Junon inadvertently authorized a reset of the two-factor authentication protecting his npm account. The malware targets cryptocurrency transactions on various blockchains such as Ethereum, Bitcoin, Solana, and Tron. In posts to Bluesky and GitHub on Monday, Junon acknowledged that a phishing email had duped him, allowing miscreants to take over his account. "Sorry everyone, I should have paid more attention," Junon wrote. "Not like me; have had a stressful week. Will work to get this cleaned up." The phishing email came from support@npmjs.help rather than npmjs.com, and several other developers have reported receiving a similar message. Junon (Qix-) on GitHub has contributed to at least 80 npm packages. He identified 18 packages that have been affected. "This appears targeted, or at least with a filter for high downloads," he wrote. "Many other packages on my account are untouched." Charlie Eriksen, security researcher at Aikido Security, said in a blog post that the firm detected the attack on September 8 at 1316 UTC. "The packages were updated to contain a piece of code that would be executed on the client of a website, which silently intercepts crypto and web3 activity in the browser, manipulates wallet interactions, and rewrites payment destinations so that funds and approvals are redirected to attacker-controlled accounts without any obvious signs to the user," Eriksen wrote. The 18 compromised p...