{"id":2814,"date":"2025-09-14T16:52:46","date_gmt":"2025-09-14T16:52:46","guid":{"rendered":"https:\/\/ft365.org\/index.php\/2025\/09\/14\/malicious-npm-code-reached-10-of-cloud-environments\/"},"modified":"2025-09-14T16:52:46","modified_gmt":"2025-09-14T16:52:46","slug":"malicious-npm-code-reached-10-of-cloud-environments","status":"publish","type":"post","link":"https:\/\/ft365.org\/index.php\/2025\/09\/14\/malicious-npm-code-reached-10-of-cloud-environments\/","title":{"rendered":"Malicious npm Code Reached 10% of Cloud Environments"},"content":{"rendered":"
\n

\"Photo<\/p>\n<\/div>\n

\n

Security experts have warned that a newly discovered supply chain attack targeting npm packages is still active\u00a0and may already have impacted 10% of cloud environments.<\/p>\n

On Monday, a threat actor hijacked the npm account of a well-known developer, \u201cqix,\u201d via social engineering, before publishing trojanized versions of popular packages.<\/p>\n

Although these malicious versions, which contained crypto-stealing malware, were removed within just two hours, security vendor Wiz has claimed they managed to reach 1 in 10 cloud environments.<\/p>\n

\u201cDuring the short two-hour timeframe in which the versions were available for download, if they were incorporated into frontend builds and shipped as web assets, any browsers loading the affected website would execute a malicious payload that hooks network and wallet APIs in order to silently rewrite cryptocurrency recipients\/approvals before signing, so that transactions would be diverted to attacker-controlled wallets,\u201d the vendor claimed.<\/p>\n

\u201cFollowing the release of the malicious versions, our data shows that the malicious code itself could be found in at least 10% of cloud environments, present in bundles or assets.\u201d<\/p>\n

Read more on open source threats: Malicious Open Source Packages Surge 188% Annually<\/em><\/p>\n

Wiz also cited research from JFrog indicating that the campaign extends beyond qix to other npm accounts.<\/p>\n

\u201cAfter the initial batch of infected packages, we identified a few more compromised accounts, including\u00a0duckdb, which indicates that the campaign is still active,\u201d the supply chain security vendor wrote.<\/p>\n

Malicious packages included @duckdb\/node-api@1.3.3, @duckdb\/duckdb-wasm@1.29.2, @duckdb\/node-bindings@1.3.3, and duckdb@1.3.3. The good news is that these were also removed quickly and received \u201calmost no downloads,\u201d according to JFrog.<\/p>\n

No Time to Relax<\/h2>\n

Users of what is the world\u2019s largest software registry, NPM, were urged to stay vigilant.<\/p>\n

\u201cTreat the list as evolving; validate against your registry\/mirror and keep blocklists current,\u201d said Wiz.<\/p>\n

The cloud security vendor had the following advice for security teams:<\/p>\n