The biggest attack on the npm supply chain

In September 2025, a supply chain attack shook the open-source world: at least 18 widely used npm packages, with more than 2 billion downloads per week between them, were compromised with malicious code. For IT security decision-makers, this is a wake-up call to scrutinise the risks in their own software supply chain.

What happened in the npm attack

A maintainer (username "qix") fell for a phishing email. This gave attackers access to his npm account and let them publish new, manipulated package versions. The malware specifically targeted crypto transactions: it embedded itself in the browser, monitored Web3 activity, manipulated wallet interactions and silently changed destination addresses to redirect transactions to attacker-controlled wallets.

The attack was detected and contained quickly, so the immediate financial damage remained small. Initial analysis by the Security Alliance found around 5 cents in ETH and roughly 20 US dollars in memecoins in the attackers' hands; later analyses of the attacker wallets put the total at a few hundred US dollars. Experts warn, however, that a similar incident with a more aggressive payload (such as espionage or ransomware) would have far more serious consequences for thousands of companies (KrebsOnSecurity).

Software supply chain attacks like this one are increasing rapidly. Gartner predicts that by 2025, 45% of organisations worldwide will have experienced such an attack, three times as many as in 2021.

How to check whether your company is affected

Companies using npm packages should check immediately whether compromised versions have been included.

Search your codebase

The following command searches JavaScript files specifically for the malicious code artefact _0x112fa8:

rg -uu --max-columns=80 --glob '*.js' _0x112fa8

If there are any hits, extreme caution is required: remove or update the affected components immediately.

Affected package versions

The following package versions are known to be compromised:

• ansi-styles@6.2.2
• debug@4.4.2 (already unpublished as of 8 September, 18:09 CEST)
• chalk@5.6.1
• supports-color@10.2.1
• strip-ansi@7.1.1
• ansi-regex@6.2.1
• wrap-ansi@9.0.1
• color-convert@3.1.1
• color-name@2.0.1
• is-arrayish@0.3.3
• slice-ansi@7.1.1
• color@5.0.1
• color-string@2.1.1
• simple-swizzle@0.2.3
• supports-hyperlinks@4.1.1
• has-ansi@6.0.1
• chalk-template@1.1.1
• backslash@0.2.1
• error-ex@1.3.3

Recommendation: check your dependencies (e.g. with npm ls or yarn list) and update compromised packages to safe versions immediately.

Challenges for companies and CISOs

For CISOs, CIOs and IT leaders, this incident highlights how hard it is to manage open-source dependencies. Modern applications are built on countless external libraries, and even trusted modules can become a threat overnight. The crux: you have to trust not only your direct software suppliers but also all of their suppliers. A single compromised package can potentially infect hundreds of applications across many companies.

Detecting such attacks is difficult. The malicious code is often cleverly obfuscated, and conventional security measures do not immediately recognise it as a threat. In this npm case, the malware only acted under specific conditions (in the browser during crypto transactions), which initially left it unnoticed in many environments (BleepingComputer).

Response time is critical. Only a short time passed between the publication of the manipulated versions and their discovery, yet every company that deployed or built within that window had to clean up its systems at considerable expense afterwards. The direct financial damage was minimal, but the follow-on costs were substantial: teams worldwide spent thousands of hours on incident response and remediation, and the incident will trigger many new security investments. This effort and the potential reputational damage ultimately fall on the companies themselves. The challenge, then, is to manage such risks preventively and to be informed immediately when an incident occurs, so the damage stays limited.

How blacklens.io helps

blacklens.io comes in where supply chain risks become visible from the outside. The platform provides continuous Attack Surface Management: all external IT assets and their vulnerabilities are recorded and monitored on an ongoing basis. This includes technology fingerprinting that shows which products run on your web assets and services. The early warning system for new threats continuously matches new CVEs against this technology inventory and verifies matches with a scan where a verification template exists. Checking the dependency tree in your own code remains a job for lockfiles and tools such as npm ls, as described above.

A proactive security approach gives IT leadership tangible advantages:

• Early warning for new vulnerabilities: new CVEs are continuously matched against the technologies on your attack surface. Alerts reach the responsible team by e-mail, push notification or integrations such as Jira, Microsoft Teams or Slack.
• Visibility of your attack surface: continuous attack surface management shows which assets, services and technologies are reachable from the outside. When a vulnerability becomes known in a specific product, you can quickly see which of your assets may be affected.
• Lower risk of compromise: automated vulnerability and leak scans close many attack paths in advance, whether through outdated software, misconfigurations or leaked credentials. This makes it harder for attackers to get in, even if a gap opens somewhere in the supply chain.
• Faster prioritisation: for every Threat Center match, blacklens.io shows the affected assets and signals such as CVSS, EPSS, KEV listing and available exploits at a glance. This saves time in assessment and containment.
• Trust and compliance: showing that you have your supply chain risks under control strengthens the trust of customers and partners. Many industry standards and regulators now require supply chain risk management, and blacklens.io supports you with the evidence and reports you need.

Conclusion and outlook

The npm supply chain attack shows that even widely used open-source components can suddenly turn into a threat. For companies, this means prevention over cure. CISOs and IT leaders should draw the lessons now, from more rigorous vetting and securing of software suppliers to introducing continuous attack surface monitoring. Investing in proactive security platforms such as blacklens.io pays off because risks are detected and mitigated early.

How quickly the next wave arrives became clear a few days later, when the Shai-Hulud campaign compromised npm packages from CrowdStrike, among many others. Act now to protect your organisation from the next wave of supply chain attacks, before attackers find the weak points in the connections you trust. Do not trust blindly: use the right tools to gain transparency and control over your entire digital supply chain.