Security Advisory: Another well-known developer's NPM account has been compromised, injecting wallet-stealing malware

By: theblockbeats.news|2025/09/10 00:02:41
0
Share
copy

BlockBeats News, September 9th. According to Socket monitoring, the ongoing NPM supply chain attack has spread from the well-known developer Qix to another highly prominent maintainer. The NPM account duckdb_admin, responsible for the DuckDB-related package, has been compromised, and multiple malicious versions have been published. The injected code is the same wallet-stealing malware used when Qix's account was compromised, strongly indicating that both are part of the same attack campaign.

Previously reported, Ledger's CTO stated that in the event of a large-scale supply chain attack, the entire JavaScript ecosystem could be at risk. However, the NPM attackers were not successful, and there were almost no victims.

You may also like

MegaETH Co-founder: 48 Hours After Leaving Dubai, I Reassessed the Entire Crypto Space

In an era of technological upheaval, rather than pursuing the "legitimacy" co-opted by power, it is better to sharpen the blade and build parallel systems that truly expand individual sovereignty.

Web3 Winter Mass Exodus: Resignations, Closures, Transformations, and Acquisitions

The intense collision between technology and capital, products and markets, vision and reality, each story reflects the confusion and unwillingness of the market participants.

Key Market Information Discrepancy on March 4th — A Must-Read! | Alpha Morning Report

1. Top News: Strait of Hormuz Emerges as Flashpoint in US-Iran Standoff, US Stocks Trim Losses, Asia-Pacific Markets Open Sharply Lower, Cryptocurrencies See Slight Recovery 2. Token Unlock: None

During the weekend market closure, Hyperliquid more accurately predicted the Gold reopening price than Binance

When markets are closed and real-time pricing is needed due to geopolitical risks, Hyperliquid takes the lead and is closer to the eventual futures reopening price.

OpenClaw thrusts crypto project Venice.ai into the spotlight as its token VVV surges over 500% in a single month

Openclaw Founder Advises Young People "Not to Waste Time on Cryptocurrency," Yet in its official documentation, it lists the cryptocurrency project Venice.ai as a recommended model provider.

Different Rulings in Similar Cases: Why can Uniswap go free while Tornado Cash cannot?

Time and tide wait for no man.

Popular coins

Latest Crypto News

Read more