Massive supply chain attack on npm has compromised popular packages, injecting malicious code that unsuspecting developers installed unknowingly.
How it works:
Clipboard hijacking:
When you paste a wallet address, the malware stealthily swaps it with an attacker-controlled address that’s visually identical to the real one, making the change nearly impossible to spot.
Transaction interception:
It hooks into your wallet’s functions so that when you initiate a transaction, the recipient address is altered behind the scenes before the confirmation prompt even appears.
Scope and impact:
This injected code embeds itself in browsers and monitors outgoing transfers across Ethereum, Bitcoin, Solana, Tron, Litecoin and Bitcoin Cash, redirecting funds to attacker-owned addresses. Applications built on outdated codebases appear unaffected, but every user should assume risk until a fix is deployed.
What you should do:
- Hardware wallet users:
Verify each transaction request on your device before signing.
- Non-hardware wallet users:
Pause all on-chain transactions until patches are released.
Stay safe out there!
English
