The Biggest Attack on the npm Supply Chain

Introduction: the biggest npm supply chain attack in history

In September 2025, a supply chain attack shook the open-source world: 18 widely used npm packages – together more than 2 billion downloads per week – were compromised with malicious code. A maintainer (username "qix") fell for a phishing email, giving attackers access to the npm account and allowing them to publish new, manipulated package versions. The malware specifically targeted crypto transactions: it embedded itself in the browser, monitored Web3 activity, manipulated wallet interactions and silently changed destination addresses to redirect transactions to attacker-controlled wallets. Fortunately, the attack was detected and contained quickly, so the immediate financial damage remained small – according to reports, the attackers made off with only a few cents in cryptocurrency. But experts warn that a similar incident with a more aggressive payload (such as espionage or ransomware) would have far more devastating consequences for thousands of companiesKrebsOnSecurity. Software supply chain attacks like this one are increasing rapidly: Gartner predicts that by 2025, 45% of organisations worldwide will have experienced such an attack (three times as many as in 2021). For IT security decision-makers, this is a wake-up call to urgently scrutinise the risks in their own software supply chain.

How to check whether your company is affected

Companies using npm packages should check immediately whether compromised versions have been included.

Search your codebase

The following command lets you search JavaScript files specifically for the malicious code artefacts (_0x112fa8):

rg -uu --max-columns=80 --glob '*.js' _0x112fa8

If there are any hits, extreme caution is required – the affected components should be removed or updated immediately.

Specifically affected package versions

As things currently stand, the following packages are compromised:

• ansi-styles@6.2.2
• debug@4.4.2 (already unpublished as of 8 Sep, 18:09 CEST)
• chalk@5.6.1
• supports-color@10.2.1
• strip-ansi@7.1.1
• ansi-regex@6.2.1
• wrap-ansi@9.0.1
• color-convert@3.1.1
• color-name@2.0.1
• is-arrayish@0.3.3
• slice-ansi@7.1.1
• color@5.0.1
• color-string@2.1.1
• simple-swizzle@0.2.3
• supports-hyperlinks@4.1.1
• has-ansi@6.0.1
• chalk-template@1.1.1
• backslash@0.2.1

Recommendation: Check your dependencies (e.g. with npm ls or yarn list) and update compromised packages to safe versions immediately.

Challenges for companies and CISOs

For CISOs, CIOs and IT leaders, this incident highlights the considerable challenges of managing open-source dependencies. Modern applications are built on countless external libraries – even trusted modules can become a threat overnight. The crux: you not only have to trust your direct software suppliers but also all of their suppliers. A single compromised package can potentially infect hundreds of applications across a wide range of companies. Detecting such attacks is difficult because the malicious code is often cleverly obfuscated and conventional security measures do not immediately recognise it as a threat. In this npm case, the malware only acted under specific conditions (in the browser during crypto transactions), which initially left it unnoticed in many environmentsBleepingComputer. Response time is critical: only a short time passed between the publication of the manipulated versions and their discovery – but every company that deployed or built within that window subsequently had to clean up its systems at considerable expense. While the direct financial damage remained minimal, the follow-on costs were substantial: teams worldwide invested thousands of hours in incident response and remediation, and the incident will trigger numerous new security investments. This effort and the potential reputational damage ultimately hit the companies themselves. The challenge, then, is to manage such risks preventively and to be informed immediately in the event of an incident in order to limit the damage.

How blacklens.io helps

This is where blacklens.io comes in as a comprehensive cyber security platform that proactively arms companies against supply chain threats of this kind. blacklens.io offers holistic attack surface management, meaning that all external IT assets and their vulnerabilities are continuously recorded and monitored. This also includes monitoring the technologies and components in use – if, for example, one of your web assets suddenly depends on a known vulnerable or compromised library, this can be detected early. In particular, the Emerging Threat Scanning & Notifications feature warns you of new threats in real time. If your company were affected by the npm attack, blacklens.io would inform you immediately about the compromised packages and provide recommendations for action.

Concrete benefits for CISOs, CIOs and co.

A proactive security approach using platforms such as blacklens.io offers IT leadership tangible advantages:

• Early warning system for new threats: You learn immediately about critical incidents such as the npm supply chain attack and can initiate countermeasures right away, before wider publicity causes damage.
• Transparency across your attack surface: Continuous attack surface management means you know exactly which assets and third-party components you are using. This enables a quick assessment of whether your company is affected by the failure or compromise of a particular library.
• Reduced risk of compromise: Automated vulnerability and leak scans allow many attack paths – whether via outdated software, misconfigurations or leaked credentials – to be closed in advance. This makes it harder for attackers to get in, even if a gap opens somewhere in the supply chain.
• Efficient incident response: Should an incident occur nonetheless, blacklens.io delivers context-rich information (e.g. affected assets, indicators of compromise) at a glance. This saves valuable time in root cause analysis and containment.
• Building trust and compliance: By demonstrating that you have your supply chain risks under control, you strengthen the trust of customers and partners. Many industry standards and regulators now require supply chain risk management – blacklens.io supports you with the necessary evidence and reports.

Conclusion and outlook

The recent npm supply chain attack is a stark reminder that even widely used open-source components can abruptly turn into a threat. For companies this means: prevention over cure. CISOs and IT leaders should draw the lessons now – from more rigorous vetting and securing of software suppliers to introducing solutions for continuous attack surface monitoring. Investing in proactive security platforms such as blacklens.io pays off by detecting and mitigating risks early. Given the forecast of rapidly increasing supply chain attacks, it is crucial to set the course today. Act now to protect your organisation from the next wave of supply chain attacks – before attackers find the weaknesses in your trusted connections. Do not trust blindly; instead, use the right tools to gain the necessary transparency and control over your entire digital supply chain.

Further information: If you would like to learn more about how blacklens.io can strengthen your security strategy, we are happy to advise you. Learn how a comprehensive attack surface management platform helps to detect incidents like the npm attack in time and respond to them effectively. Because one thing is certain: in today's threat landscape, those who are prepared win.