Phishing gates the gatekeepers: how one email hijacked NPM's most-downloaded packages
The NPM ecosystem trusts maintainers. When attackers broke that trust in September 2025, the ripple effect touched over 2.6 billion weekly downloads. The chain started not with a code repository breach but with a phishing email landed in a maintainer's inbox. Sergiu Gatlan reported the incident on BleepingComputer, and the details read like a cautionary tale about social engineering meeting open-source trust.
The first warning sign came through a domain that looked almost legitimate: [email protected]. The dot-help suffix masked a impostor site mimicking the real npmjs.com. In the emails, attackers wielded a familiar scare tactic. Recipients were told their accounts would be locked on September 10th, 2025, unless they updated their Two-Factor Authentication credentials immediately. The language was direct: "As part of our ongoing commitment to account security, we are requesting that all users update their Two-Factor Authentication (2FA) credentials. Our records indicate that it has been over 12 months since your last 2FA update." A secondary line added urgency: "To maintain the security and integrity of your account, we kindly ask that you complete this update at your earliest convenience. Please note that accounts with outdated 2FA credentials will be temporarily locked starting September 10, 2025, to prevent unauthorized access." The ploy worked. Package maintainer Josh Junon (qix) confirmed he had been compromised, and BleepingComputer found that the npmjs.help page featured a login form that exfiltrated entered credentials to https://websocket-api2.publicvm.com/images/jpg-to-png.php?name=[name]&pass=[password]. Other developers reported receiving the same message, indicating a coordinated campaign rather than an isolated attempt.
Once inside a maintainer's account, the attackers didn't stop at credential theft. They pushed malicious versions into NPM packages that collectively download over 2.6 billion times each week. Aikido Security analyzed the supply-chain attack and detailed how the threat actors updated the packages after taking over control, injecting malicious code that acts as a browser-based interceptor into the index.js files. The malware monitors network traffic in the browser, specifically looking for cryptocurrency addresses and transactions. When a user initiates a transfer, the code rewrites the destination to an attacker-controlled wallet address. Supported blockchains include Ethereum, Bitcoin, Solana, Tron, Litecoin, and Bitcoin Cash. The mechanism hooks standard JavaScript functions — fetch, XMLHttpRequest — and wallet APIs such as window.ethereum. On network responses containing crypto transactions, the interceptor silently replaces the destination address, and the transaction is hijacked before it's ever signed.
Not every user who installed a affected package experienced the hijack. Aikido Security and BleepingComputer identified specific conditions that must align for the malware to activate. A fresh install must occur between approximately 9 AM and 11:30 AM Eastern Time, the window when the packages were initially compromised. Additionally, a package-lock.json must have been created during that narrow timeframe. Vulnerable packages may appear in direct or transitive dependencies, but the timing constraint significantly narrows the pool of impacted installations. Aikido researcher Charlie Eriksen summed up the danger: "The packages were updated to contain a piece of code that would be executed on the client of a website, which silently intercepts crypto and web3 activity in the browser, manipulates wallet interactions, and rewrites payment destinations so that funds and approvals are redirected to attacker-controlled accounts without any obvious signs to the user." What makes the threat more unnerving is that it operates at multiple layers: altering content shown on websites, tampering with API calls, and manipulating what users' apps believe they are signing.
The NPM supply chain has seen similar breaches in the months leading up to this incident. In July 2025, attackers compromised eslint-config-prettier, a package with over 30 million weekly downloads. Earlier that year, in March, ten widely used npm libraries were hijacked and turned into info-stealers. The pattern reveals a growing willingness to target developers as a gateway into downstream users. The phishing attack and the injected malware together illustrate how the web browser has become a massive attack surface for stealing credentials, modifying traffic, and breaching networks. BleepingComputer even hosted a webinar later that month titled "Your Browser Is the Breach: Securing the Modern Web Edge," focusing on recent browser attacks and defense strategies for this exact vector.
Even after credentials are obtained, prevention is far from guaranteed. The Blue Report 2026, which measures defenses technique by technique across 338 million simulations run in customer production environments, found that once attackers have valid credentials, only 37% of their actions are blocked. Overall prevention scores can mask what happens after initial access; once an attacker is using legitimate credentials, defense drops sharply. That statistic alone reframes the conversation: the perimeter is no longer the primary boundary. The boundary lies inside the session, inside the browser, inside the trust a user grants a newly installed package.
What's clear from the September 2025 NPM incident is that supply chain attacks no longer need a repository exploit. They can begin with a single phishing email, ride compromised maintainer credentials, and emerge as browser-based interceptors affecting billions of weekly downloads. The attack's scale — 2.6 billion downloads per week across 30-plus packages — makes it one of the largest publicly documented NPM compromises to date. The specific criteria for impact mean the fallout is concentrated, but the precedent is now set: a phishing campaign can cascade into a coordinated package injection with global reach.
The lessons are practical. Developers should treat 2FA update requests with skepticism, especially when they arrive from a new domain or demand immediate action. Package consumers can review lockfiles and be mindful of install timing, though these workarounds offer only partial protection. And the industry at large must reckon with the browser as the new frontier of supply chain risk, where a single compromised credential can silently redirect cryptocurrency transactions and rewrite API calls in real time. The NPM attack of September 2025 won't be the last time a phishing email topples a maintainer and, by extension, reaches millions of downstream users. But understanding how the chain breaks — from the inbox to the index.js file to the wallet address on screen — is the first step toward building defenses that keep pace.
Attribution and the arms race that follows
North Korean threat actors have been linked to several high-profile NPM supply-chain incidents, including the Debug and Chalk attacks that BleepingComputer reported on in the weeks following the phishing discovery. The timing and code patterns in the injected interceptor suggest a level of coordination consistent with state-backed operations seeking financial intelligence rather than mere vandalism. Crypto wallet addresses observed in the BleepingComputer report have appeared in other forensic tracks, connecting this single phishing campaign to a broader pattern of digital theft. Whether the ultimate origin is a nation-state actor or a sophisticated criminal syndicate, the mechanism remains the same: trust is subverted at the human layer, code is injected at the package layer, and the financial payoff is extracted at the blockchain layer. The industry's response will likely involve tighter maintainer vetting, real-time package behavior monitoring, and better browser-level warnings for crypto-related API anomalies. But as this attack demonstrates, every new defense prompts an adaptive adversary to find the next social-engineering vector, and the cycle continues.
The NPM compromise of September 2025 is a case study in how quickly a single phishing email can cascade into a global supply chain threat. From the impersonated [email protected] address to the 2.6 billion weekly downloads under the malicious code's reach, the attack surface was vast and the impact real. Yet the conditions for impact — the time-of-install window, the lockfile constraint — show that scale does not equal universal compromise. Some users escaped unscathed simply because their install timing did not align with the narrow attack window. That small mercy is cold comfort when the potential exists for billions of transactions to be intercepted. What matters now is how the community absorbs the lesson: that trust in open-source maintainers must be met with the same scrutiny we reserve for external actors, and that the browser, long treated as a safe execution environment, now demands the same defensive rigor as any network perimeter. The phishing email that started this chain is gone, but the questions it raised about maintainer security, browser integrity, and the true cost of 2.6 billion daily downloads will echo through the NPM ecosystem for as long as developers keep shipping code and users keep installing it.