18 Popular Code Packages Hacked, Rigged to Steal Crypto
Summary: At least 18 popular JavaScript packages on NPM, collectively downloaded more than two billion times each week, were briefly compromised after a phishing email lured maintainer Josh Junon to a fake NPM login page that captured his credentials and one-time 2FA token. The attackers injected code that Aikido described as a browser-based interceptor rewriting payment destinations to redirect cryptocurrency funds and approvals to attacker-controlled accounts, and the packages were being cleaned up within hours of Aikido's 15:15 UTC notice.
Why it matters: A single phished one-time token gave attackers control over code pulled into billions of weekly downloads, and as Kevin Beaumont noted, much of the planet runs on libraries maintained by an exceedingly small number of overburdened people - so the next payload need not be crypto theft.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026