Compromised files replace NPM packages with combined downloads of 2 billion weekly

• More than a dozen popular NPM packages have been compromised in a phishing -based supply chain attack
• Malventy software has targeted crypto users by diverting wallet addresses during transactions
• Some have called it the most common NPM compromise to date, affecting 2 billion weekly downloads

More than a dozen NPM packages with two billion downloads per week were compromised in a supply chain attack that targeted cryptocurrency users.

Researchers from Aikido Security have spotted a QIX responsible account (the real name Josh Juno) publishing malicious updates. In less than an hour, several versions were downloaded, and shortly after Juno himself confirmed the attack and apologized for disorder,