Compromed files Replace NPM packages with a combined 2 billion weekly downloads

• Over a dozen popular NPM packages were compromised in a phishing-based supply chain attack
• Malware targeted crypto users by hijacking drawing addresses under transactions
• Some called it the most widespread NPM Compromis to date that affects 2 billion weekly downloads

More than a dozen NPM packages with two billion downloads a week were compromised in a supply chain attack that targeted cryptocurrency users.

Researchers at Aikido Security discovered a maintenance account qix (real name Josh Junon) that published malicious updates. In less than an hour, several versions were uploaded, and shortly after Junon even confirmed the attack and apologized for messy,