In what is being dubbed as the largest supply chain attack in history, hackers have compromised key JavaScript libraries like chalk, strip-ansi, and color-convert, which are downloaded billions of times each week. The breach is raising alarms over the security of open-source software, particularly in the context of crypto transactions.
The attackers gained access to a node package manager (NPM) account belonging to a well-known developer and secretly inserted malware into these widely used libraries. The infected code is specifically designed to target crypto wallets by swapping wallet addresses and intercepting transactions, leading to potential theft of funds.
Malware targets critical JavaScript libraries
The affected libraries, like chalk and strip-ansi, are small utilities that are buried deep within the dependency trees of countless JavaScript projects. Despite being seemingly minor, these packages are downloaded over a billion times each week, making them ubiquitous in the development community. As a result, the attack has put billions of downloads’ worth of projects at risk, even if developers never directly installed these libraries themselves.
NPM, a central library where developers share and download code packages, operates like an app store for developers. It’s used by a vast number of developers to source code for JavaScript projects, meaning the scope of the breach is far-reaching and could have major security implications for the broader development ecosystem.
Attack uses crypto-clipper malware to hijack wallet addresses
The malware in question is believed to be a crypto-clipper, a type of malicious software that silently replaces wallet addresses during transactions, diverting funds to the attacker’s wallet. This method of attack raises particular concerns for software wallets, which may be more vulnerable to exploitation. However, hardware wallets, where users must manually confirm each transaction, remain protected from this type of attack.
The full extent of the attack is still unclear, particularly whether the malware attempts to steal seed phrases or other sensitive information. However, researchers have already raised alarms about the wide-reaching implications for the security of open-source software and the crypto community at large.