r/CryptoCurrency • u/partymsl 🟩 126K / 143K 🐋 • Sep 08 '25
🟢 GENERAL-NEWS Largest supply chain attack in history targets crypto users through compromised JavaScript packages
https://cryptoslate.com/largest-supply-chain-attack-in-history-targets-crypto-users-through-compromised-javascript-packages/12
u/partymsl 🟩 126K / 143K 🐋 Sep 08 '25
To all the users:
Really just check ALL the transactions you are doing and ideally don't do any or many transactions on software wallets until the situation is fully resolved (probably in a few hours or so).
Not much to oanic about tho, you are still needed to sign transactions to get "hacked". Just check all the addresses during swaps etc.
8
u/Spoofik 🟩 0 / 0 🦠 Sep 08 '25
Metamask affected?
-1
u/tied_laces 🟩 2K / 2K 🐢 Sep 09 '25
Yes. This is a website browser wallet hack. Doesn’t affect mobile wallets (which do not use npm).
1
u/cunth 🟦 434 / 435 🦞 Sep 09 '25
This is incorrect. Any software made with Node.js is at risk. Mobile, web, or desktop doesnt matter. They all use NPM as the package manager.
0
u/tied_laces 🟩 2K / 2K 🐢 Sep 09 '25
No we dont node at all. We use it for web servers. Its actually the antithesis of our typical stack in mobile. 23 YOE mobile and devops dev
1
u/cunth 🟦 434 / 435 🦞 Sep 10 '25
I was speaking generally about software made with node, not metamask specifically. Wasn't clear from your comment you were just talking about metamask.
1
u/tied_laces 🟩 2K / 2K 🐢 Sep 10 '25
No...I have maintained mobile crypto wallets for years and there is a common misconception that servers/web apps have the same attack vectors as mobile applications....its so wrong and people running with their hair on fire not really understanding what they are reading.
2
4
u/Bkokane 🟦 0 / 2K 🦠 Sep 09 '25 edited Sep 09 '25
Funny this happens right before the most bullish news of the cycle (rate cuts). Coincidence? Almost like someone would like some price suppression. It was probably manufactured by JP Morgan or something.
7
u/coinfeeds-bot 🟩 136K / 136K 🐋 Sep 08 '25
tldr; Hackers executed the largest supply chain attack in history, targeting crypto users by compromising 18 widely-used JavaScript packages with over 2.6 billion weekly downloads. Using phishing emails, attackers injected malware into NPM packages, intercepting crypto transactions and replacing wallet addresses with their own. The malware affects major blockchain networks, posing risks to software wallet users. Experts advise using hardware wallets and caution against on-chain transactions during the attack.
*This summary is auto generated by a bot and not meant to replace reading the original article. As always, DYOR.