What happened
npm is the main registry of JavaScript packages. Josh Junon, known online as qix, maintains some of its most widely used ones, including chalk and debug. On 8 September 2025 an attacker used his account to publish poisoned versions of 18 packages. Check Point put their combined weekly downloads at over 2 billion.
The security company Aikido flagged the malicious versions in its feed at 13:16 UTC. Junon acknowledged the compromise at about 15:15 UTC. In a public message quoted by The Register, he apologised and said he should have paid more attention. The malicious versions were removed.
The email
The message came from support@npmjs.help, posing as npm's support team. The real registry is npmjs.com. Check Point found that the attacker registered npmjs.help on 5 September, three days before the attack.
BleepingComputer reported the pretext. The email said it had been over 12 months since his last two-factor update, and that accounts not updated would be locked from 10 September 2025. Check Point described the warning as a lock within 48 hours. The link led to a fake login page. It captured his username, his password and a live two-factor code, and The Register reported that he inadvertently authorised a reset of his two-factor authentication.
Why it worked
Every element pointed at a routine security task. The sender named npm's own support. The domain began with npmjs. The request was to improve security, not weaken it. The deadline was short enough to push for action and plausible enough to sound like policy. A maintainer who handles many such notices would see nothing unusual in the subject.
The two-factor code did not help, because the fake page passed it on in real time. Codes typed into a page protect against a stolen password. They do not protect against a fake page that asks for both at once.
What it cost
The injected code ran in web browsers. Aikido found that it swapped cryptocurrency wallet addresses and transaction recipients, so that payments made through affected sites could go to the attacker. Because the packages are dependencies of many other packages, the poisoned versions could reach build systems around the world before they were pulled. BleepingComputer later revised its report to say the attack was not as impactful as first thought.
What would have helped
Sign-in with a passkey or a hardware security key, which checks the website's real address, would have given the fake page nothing to relay. For registries, requiring such keys for maintainers of widely used packages limits the damage one email can do.
What a warning inside the message would have shown. Antilure flags a sender domain that imitates a brand, and marks wording that creates time pressure or asks for sign-in details. Its Details panel shows the link's real destination. The banner on such a message says: don't click links or reply. A message from npmjs.help that asks for a two-factor update before a deadline carries each of those signs.
Sources
- npm debug and chalk packages compromised, Aikido Security, 8 September 2025.
- Hackers hijack npm packages with 2 billion weekly downloads in supply chain attack, Sergiu Gatlan, BleepingComputer, 8 September 2025.
- Dev snared in crypto phishing net, 18 npm packages compromised, Thomas Claburn, The Register, 8 September 2025.
- The Great NPM Heist, September 2025, Check Point, 10 September 2025.