Ethereum, Solana Wallets Targeted in Massive 'npm' Attack But Just 5 Cents Taken

A phishing email connected Monday took down 1 of Node.js’s astir prolific developers by pushing malicious codification into packages downloaded billions of times a week, successful what researchers telephone the largest bundle supply-chain onslaught successful caller times.

While the scope of the onslaught is massive, Security Alliance said successful a Tuesday report that the attacker walked distant with hardly a fewer cents. However, information teams present look the important outgo of updating backend systems to antagonistic further attacks.

A precise fashionable maintainer whose enactment (like chalk and debug-js) gets utilized successful billions of downloads each week, known arsenic “qix,” liable for libraries specified arsenic chalk and debug-js, was compromised past week aft receiving an email from support@npmjs[.]help. The domain erstwhile pointed to a Russian server and redirected to a spoofed two-factor authentication leafage hosted connected the contented transportation web BunnyCDN.

The credential stealer harvested username, password, and 2FA codes earlier sending them to a distant host. With afloat access, the attacker republished each qix bundle with a crypto-focused payload.

Node Package Manager (shortened to npm, not NPM) is similar an app store for developers and is wherever coders download small gathering blocks of codification (called packages) alternatively of penning everything from scratch. A maintainer is the idiosyncratic oregon entity who creates and updates those packages.

How the onslaught happened

The injected codification was simple. It checked if window.ethereum was contiguous and, if so, hooked into Ethereum’s halfway transaction functions. Calls to approve, permit, transfer, oregon transferFrom were silently rerouted to a azygous wallet, “0xFc4a4858bafef54D1b1d7697bfb5c52F4c166976.”

Any Ethereum transaction with worth and nary information was besides redirected. For Solana, the malware overwrote recipients with an invalid drawstring opening “1911…,” breaking transfers outright.

Network requests were besides intercepted.

By hijacking fetch and XMLHttpRequest, the malware scanned JSON responses for substrings resembling wallet addresses and replaced them with 1 of 280 hardcoded alternatives to look deceptively similar.

Impact of the attack

But for each the distribution, the interaction was negligible.

On-chain information shows the attacker received lone astir 5 cents of ether and astir $20 worthy of an illiquid memecoin that traded little than $600 successful volume, the Security Alliance study said.

Popular browser wallet MetaMask besides said connected X that it was not affected by the npm proviso concatenation onslaught arsenic the wallet locks its codification versions, uses manual and automated checks, and releases updates successful stages. It besides employs "LavaMoat," which blocks malicious codification adjacent if inserted, and "Blockaid," which rapidly flags compromised wallet addresses, to support specified attacks astatine bay.

Meanwhile, Ledger CTO Charles Guillemet warned that the malicious codification had been pushed into packages with implicit a cardinal downloads and was designed to silently regenerate wallet addresses successful transactions.

The onslaught follows different case flagged past week by ReversingLabs, wherever npm packages utilized Ethereum astute contracts to conceal malware links — a method that disguised command-and-control postulation arsenic mean blockchain calls.