Npm Supply Chain Attack Targeting Germany Based Companies

Npm Supply Chain Attack Targeting Germany-Based Companies

Npm Supply Chain Attack Targeting Germany-Based Companies Supply chain attack infects npm packages with more than 2 billion weekly downloads incident hitting npm users is likely the biggest supply chain attack ever. A massive supply chain attack compromised 18 highly popular npm packages, which collectively received two billion weekly downloads, deploying sophisticated browser based malware designed to steal.

Npm Supply Chain Attack Targeting Germany-Based Companies

Npm Supply Chain Attack Targeting Germany-Based Companies In a supply chain attack, attackers injected malware into npm packages with over 2.6 billion weekly downloads after compromising a maintainer's account in a phishing attack. What has been dubbed the largest supply chain attack in history has hit npm, one of the most prolific javascript package managers. early this morning (around 9:30 a.m. et), security researchers reported what has been called the largest supply chain attack in history. the attack affected npm, one of the main javascript package managers used by 17 million developers and downloaded 2.6 billion. Cybersecurity researchers have discovered a number of malicious packages in the npm registry specifically targeting a number of prominent media, logistics, and industrial firms based in germany to carry out supply chain attacks. The open source ecosystem has once again been shaken by a major npm supply chain attack, this time compromising 20 popular npm packages that collectively see over 2 billion weekly downloads. the attack was traced back to a phishing campaign that targeted a well known maintainer, exploiting their credentials to push malicious updates. this incident highlights not only the scale of modern supply.

Npm Supply Chain Attack Targeting Germany-Based Companies

Npm Supply Chain Attack Targeting Germany-Based Companies Cybersecurity researchers have discovered a number of malicious packages in the npm registry specifically targeting a number of prominent media, logistics, and industrial firms based in germany to carry out supply chain attacks. The open source ecosystem has once again been shaken by a major npm supply chain attack, this time compromising 20 popular npm packages that collectively see over 2 billion weekly downloads. the attack was traced back to a phishing campaign that targeted a well known maintainer, exploiting their credentials to push malicious updates. this incident highlights not only the scale of modern supply. On september 8, 2025, the javascript ecosystem experienced its most devastating supply chain attack to date when threat actors compromised the npm account of josh junon (known as "qix "), a prolific open source maintainer responsible for some of the most fundamental packages in modern web development. The qix attack is a stark reminder of the growing threat of supply chain attacks. as demonstrated by recent incidents targeting eslint config prettier and other npm libraries, attackers are increasingly focusing on the software supply chain to gain a foothold in thousands of applications simultaneously. A phishing led npm supply chain attack briefly compromised 18 popular packages (~2.6b weekly downloads), injecting code to hijack crypto wallet transactions. malicious versions were live for ~2.5 hours on sept 8, 2025, before removal. learn the impact, affected packages, iocs, and steps to secure builds, dependencies, and developer accounts.

Npm Supply Chain Attack Targeting Germany-Based Companies

Npm Supply Chain Attack Targeting Germany-Based Companies On september 8, 2025, the javascript ecosystem experienced its most devastating supply chain attack to date when threat actors compromised the npm account of josh junon (known as "qix "), a prolific open source maintainer responsible for some of the most fundamental packages in modern web development. The qix attack is a stark reminder of the growing threat of supply chain attacks. as demonstrated by recent incidents targeting eslint config prettier and other npm libraries, attackers are increasingly focusing on the software supply chain to gain a foothold in thousands of applications simultaneously. A phishing led npm supply chain attack briefly compromised 18 popular packages (~2.6b weekly downloads), injecting code to hijack crypto wallet transactions. malicious versions were live for ~2.5 hours on sept 8, 2025, before removal. learn the impact, affected packages, iocs, and steps to secure builds, dependencies, and developer accounts.

The largest supply-chain attack ever…