The NPM Malware Attack, and Why Wallets are at Risk

The NPM Malware Attack: What happened?

The open-source JavaScript ecosystem NPM has recently been hit by a major supply-chain hack. A phishing campaign against an NPM maintainer gave attackers access to popular libraries, including Chalk, Strip-ansi and debug-js; packages that are downloaded billions of times a month. Malicious code was inserted into these dependencies, turning them into vehicles for a crypto-clipper, which is a type of malware designed to silently swap wallet addresses during crypto transactions, potentially redirecting funds to the attacker. 

The NPM package maintainer ‘Qix’ fell victim to the phishing scam after receiving an email from ‘support@npmjs.help’ , asking for a 2 factor authentication update.

Phishing email received by qix requesting 2FA update. The urgent voice of the message is consistent with typical phishing messages.

The impact so far appears to have been limited, with approximately $500 stolen at the time of writing. However, the potential impact is massive, because these libraries are deeply embedded in thousands of apps and wallets. 

How Wallet Address Hijacking Works 

A crypto-clipper works by interception transaction details in software-based wallets. When a user initiates a transaction, the malware can replace the intended wallet address with one controlled by the attacker. 

The malware works by focusing on crypto wallets in web browsers, instead of attempting to infect desktops or read files. 

• It hooks into Ethereum and Solana requests, intercepting transactions. 

• For Ethereum, it replaces the destination address for operations like transfer and approve with an attacker-controlled wallet.

• For Solana, it replaces recipient addresses, effectively breaking the transactions. 

• For any network requests, it performed a simple string replacement to swap crypto addresses with attacker-controlled ones.

This method is subtle; it doesn’t install typical malware, but it can redirect funds if the user is using vulnerable browser wallets. 

How to stay protected against the attack

Developers: Pinning Dependencies as a Key Defence

Developers could reduce their risk by pinning dependencies, meaning they lock projects to specific known-safe package versions. This prevents automatic updates from bringing in malicious code. Security experts recommend using lockfiles like package-lock.json to enforce pinned versions. 

While pinning is highly effective, research shows it isn’t foolproof. Complex dependency graphs can still allow malicious updates through indirect dependencies. 

End Users: Safer Transaction Practices 

For end users, one of the simplest defences would be to use hardware wallets. These devices require you to approve addresses on a separate screen, which prevents malware from silently redirecting funds.

 Until all the compromised packages are completely cleaned up, users should also avoid browser-based apps that might rely on tainted libraries and always remain cautious with phishing emails. 

The role of Transaction Monitoring against Crypto-Clippers

Even with precautions in place, some threats can slip through. Nominis Vue, the 24/7 transaction monitoring tool by Nominis.io, continuously monitors over 70 blockchains. Even if malware swaps the intended recipient address, the transaction will still be recorded on the blockchain. Therefore, if a user’s wallet sends funds to an address that doesn’t match their normal patterns, or isn’t trusted, Nominis Vue can flag it immediately. Teams would receive immediate alerts and can intervene, before the funds are lost.

Beyond the blockchain, Vue also monitors off-chain activity using OSINT, deep web and dark web sources, identifying links to high-risk wallets, phishing campaigns or illicit marketplaces. 

Combined, these capabilities give platforms and users a second layer of defense, catching fraudulent activity whether it originates from a compromised wallet interface, or extension threats. The detailed forensic insights provided will allow for swift intervention and mitigate loss of assets. 

Screenshot from Nominis Vue demonstrating the risk score assigned to a wallet that, upon investigation, belongs to an attacker. 

Our Concluding Thoughts 

The NPM crypto-clipper incident highlights how even widely trusted open-source libraries can be exploited, putting both developers and users at risk. Developers should pin and audit dependencies carefully, while users should rely on hardware wallets, stay up-to-date on attacks, and take advantage of monitoring tools, such as Nominis Vue. Combining precautionary efforts with monitoring platforms, particularly who use both on-chain and off-chain sources, can allow users to detect suspicious transactions, prevent reduced funds from being lost, and quickly investigate incidents. 

Layering proactive defenses with continuous monitoring ensures that even if malicious code reaches production, its impact can be minimised and addresses swiftly. 

The NPM Crypto-Clipper Attack: FAQs

Q: What is a NPM? 

NPM (Node Package Manager) is the largest ecosystem for JavaScript packages. Developers use it to share, distribute and manage libraries (packages) that help to build web applications, node.js apps, and more. Fore example, instead of writing common code from scratch, a developer can install a package like chalk, to add colors to console input. NPM hosts millions of packages, making it a critical part of the JavaScript and web development ecosystem. 

Q: If the attack is so widespread, why is the impact so minimal?

Although the malware was injected into many, very widely used packages, the actual theft at the time of writing was minimal, approximately $500 at the time of writing. Reasons may include: 

• Limited exposure to vulnerable wallets: The clipper only works on software wallets in browsers, not on hardware wallets or other secure environments. 

• Early detection and removal: Many developers quickly removed or patched the compromised packages. 

Q: How do hardware wallets successfully protect users? 

Hardware wallets keep private keys offline and require on-device confirmation of every transaction. Even if malware tries to swap the recipient address in your browser, the wallet shows the true destination and blocks unauthorized changes. This secure, isolated signing process prevents funds from being predicted, keeping users safe from clipper malware. 

Q: How does crypto-clipper malware work? 

A crypto clipper intercepts wallet addresses during transactions and swaps them with attacker-controlled addresses, tricking users into sending funds to the wrong destination.

This attack is ongoing. Every effort was made to ensure information is accurate upon the time of writing. 

All research content and accompanying reports are provided for informational purposes only and should not be relied upon as professional advice. Accessing these materials does not create any professional relationship or duty of care. Readers are encouraged to consult appropriately qualified professionals for guidance. We uphold the highest standards of accuracy in all the information we provide. For any questions or feedback, please contact us at contact@nominis.io.