Eighteen widely used npm packages were pushed with malicious updates that inject obfuscated JavaScript into clients, intercepting browser network calls and wallet APIs to rewrite crypto payment destinations and transaction data to attacker-controlled addresses. The compromise originated from a phishing domain (npmjs.help) used against maintainers, and remediation includes checking versions, reinstalling packages, and using tools like Aikido SafeChain. #npmjs.help #simple-swizzle
Keypoints
- 18 popular npm packages (including chalk, debug, ansi-styles, color-convert, supports-color) were updated with malicious code affecting packages with combined weekly downloads above 2 billion.
- Malicious code hooks into browser APIs—fetch, XMLHttpRequest—and wallet interfaces (window.ethereum, Solana) to intercept and modify network responses and transaction payloads in the client.
- The payload scans for multiple crypto address formats (Ethereum, Bitcoin, Bitcoin Cash, Solana, Tron, Litecoin) and replaces legitimate destinations or approval targets with attacker-controlled addresses, often using look‑alike replacements to avoid detection.
- Attackers used a phishing campaign (email from support [at] npmjs [dot] help) to compromise maintainers; the domain npmjs.help was registered days before the incident.
- Maintainers began cleanup after notification via Aikido; some compromised packages were deleted but at least simple-swizzle remained compromised at the time of reporting.
- A second, likely related compromise was detected in another package (dist/cjs/proto-tinker.cjs.entry.js) indicating the same actor(s) targeted multiple maintainers.
- Recommended remediation: verify package versions, clear npm cache, reinstall dependencies with pinned versions and package-lock, and use Aikido SafeChain and Aikido scans to detect and prevent such malware.
MITRE Techniques
- [T1059 ] Command and Scripting Interpreter – Malicious JavaScript was injected into npm packages and executed in the browser to intercept APIs and modify requests/responses (“injects itself into the browser…Hooks core functions like fetch, XMLHttpRequest, and wallet APIs (window.ethereum, Solana, etc.).”).
- [T1185 ] Man-in-the-Middle – The malware intercepts and modifies web traffic and API responses client-side, effectively performing MITM on fetch and XHR calls (“injects itself into functions like fetch, XMLHttpRequest…then silently rewrites values in requests and responses”).
- [T1499 ] Endpoint Denial of Service (functional impersonation) – The code tampers with transaction parameters and replaces destination addresses/approval targets, causing funds/approvals to be redirected to attacker accounts (“silently intercepts crypto and web3 activity…rewrites payment destinations so that funds and approvals are redirected to attacker-controlled accounts”).
- [T1592 ] Gather Victim Identity Information – The malware scans content for wallet addresses and other identifiers across multiple blockchains to locate targets for replacement (“Scans network responses and transaction payloads for anything that looks like a wallet address or transfer. Recognizes multiple formats across Ethereum, Bitcoin, Solana, Tron, Litecoin, and Bitcoin Cash.”).
- [T1566 ] Phishing – Attackers compromised maintainers via phishing emails originating from a spoofed/support domain (npmjs.help) used to gain repository access (“phishing, using this email coming from support [at] npmjs [dot] help”).
- [T1204 ] User Execution – The attack depends on users running applications in browsers that load the compromised packages, causing execution of the injected JavaScript in victim contexts (“These were … packages … updated to contain a piece of code that would be executed on the client of a website”).
Indicators of Compromise
- [Domain ] Phishing domain used to compromise maintainers – npmjs.help
- [Package ] Compromised npm packages – simple-swizzle (still compromised), chalk, debug, ansi-styles, color-convert, supports-color, strip-ansi, ansi-regex (and others from the listed 18)
- [Crypto Addresses ] Attacker-controlled Ethereum addresses observed in code – 0xFc4a4858bafef54D1b1d7697bfb5c52F4c166976, 0xa29eeFb3f21Dc8FA8bce065Db4f4354AA683c024 (and many more listed in the payload)
- [Bitcoin/Segwit ] Attacker Bitcoin/cash addresses used for replacement – bc1qms4f8ys8c4z47h0q29nnmyekc9r74u5ypqw6wm, 1H13VnQJKtT4HjD5ZFKaaiZEetMbG7nDHx (and numerous other BTC/BCH/Segwit addresses in arrays)
- [File path ] Malicious file in a secondary compromised package – dist/cjs/proto-tinker.cjs.entry.js
Read more: https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised