Supply chain attacks targeting the JavaScript ecosystem have evolved into sophisticated operations that combine domain manipulation with social engineering (via email).
On September 8, 2025, threat actors launched a coordinated phishing campaign aimed at compromising leading NPM developers.
The attack allowed attackers to infiltrate the accounts of developer Josh Junon, known as “qix.” It also targeted at least four other maintainers, exposing the vulnerability of software repositories to credential-harvesting.
The compromised packages represented nearly 2.8 billion weekly downloads, placing this incident among the most significant supply chain threats in NPM history.
See also: Hackers distribute SSH-Tor Backdoor via military documents
The phishing emails posed as official security communications NPM, claiming that recipients needed to update their two-factor authentication credentials to prevent account suspension.
This urgent message created psychological pressure on the targets. The attacker sent messages from support@npmjs[.]help, a spoofed domain designed to mirror the legitimate NPM infrastructure.
Group-IB analysts observed that the malicious emails successfully passed standard email authentication protocols, such as SPF, DKIM, and DMARC . However, multiple technical indicators revealed the campaign’s malicious intent. Each email contained a customized phishing link that directed victims to a credential harvesting website hosted on npmjs.help.
Once the developers entered their credentials on the cloned login page, the attackers gained accounts NPM.
See also: New HttpTroy backdoor disguises itself as a VPN invoice
Email Breach: JavaScript Clipper Payload
With access to the accounts secured, the threat actors introduced JavaScript clipper malware into twenty popular NPM packages.
This sophisticated payload monitored browser and application activity, specifically for interactions with cryptocurrency. When users initiated transactions involving Bitcoin, Ethereum, Solana, Tron, Litecoin, or Bitcoin Cash, the malware intercepted wallet addresses and replaced them with alternative ones controlled by the attackers (effectively diverting cryptocurrency transfers without the user’s knowledge).
Protection
This infection mechanism demonstrated the precision of modern breach operations supply chain . Group-IB’s Business Email Protection platform successfully detected this threat through a comprehensive multi-layered analysis. The detection leveraged domain intelligence through RDAP checks, brand impersonation algorithms, content analysis that identifies social engineering patterns , URL inspection that reveals credential harvesting functionality, and behavioral analysis that exposes interface replication fraud.
See also: New SkyCloak venture uses Powershell tools
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
After remediation, the affected packages were reverted to clean versions and the developers regained full control of their accounts, preventing a widespread breach.
