Massive npm Supply-Chain Attack Hits Ethereum and Solana Wallets, But Losses Minimal

A widespread supply-chain attack targeting Node.js packages briefly threatened billions of users, but on-chain data shows the attacker walked away with only a few cents. The incident, researchers say, represents one of the largest software supply-chain compromises in recent memory.

The attack began Monday with a phishing email sent to a prolific Node.js developer responsible for popular packages like chalk and debug-js, known in the community as “qix.” The email, originating from support@npmjs[.]help — a domain previously linked to a Russian server — directed the maintainer to a spoofed two-factor authentication page hosted on BunnyCDN. Once credentials were captured, including username, password, and 2FA codes, the attacker gained full access to the developer’s npm packages.

With control of the packages, the attacker republished them with a crypto-focused payload designed to redirect Ethereum and Solana transactions.

How the Malware Worked

The malicious code checked for the presence of window.ethereum and, if found, intercepted core Ethereum transaction functions such as approve, permit, transfer, and transferFrom. All transactions were silently rerouted to a single wallet: 0xFc4a4858bafef54D1b1d7697bfb5c52F4c166976.

For Solana, the malware replaced recipient addresses with invalid strings starting with “1911…,” causing transfers to fail. It also hijacked network requests via fetch and XMLHttpRequest, scanning JSON responses for wallet-like strings and replacing them with one of 280 hardcoded alternatives designed to appear legitimate.

Impact Was Minimal

Despite the massive distribution — with affected packages downloaded billions of times weekly — the financial impact was negligible. According to a Security Alliance report, the attacker obtained only around five cents in Ether and about $20 in an illiquid memecoin trading under $600 in volume.

Wallet providers were largely unaffected. MetaMask confirmed that its protections, including version-locking, staged updates, and security tools such as LavaMoat and Blockaid, blocked malicious code and flagged compromised addresses before harm could occur.

Ledger CTO Charles Guillemet warned that the malicious payload had briefly infiltrated packages with over a billion downloads, silently replacing wallet addresses in transactions. The incident follows recent cases highlighted by ReversingLabs, where npm packages used Ethereum smart contracts to conceal malware and disguise command-and-control traffic as routine blockchain activity.

While the monetary loss was tiny, security teams now face the costly task of updating backend systems and auditing code to prevent future attacks.