What Happened
A major supply chain attack has hit the npm ecosystem, compromising several of the most widely used open-source packages:
-
chalk -
debug -
ansi-styles -
simple-swizzle -
and related dependencies
Together, these packages account for billions of downloads per week, powering everything from developer utilities to web applications.
The attacker reportedly phished a package maintainer’s credentials, gained publishing access, and released malicious updates.
⚠️ FURTHER UPDATE 4/26 – Scope of Compromise Expanded
Additional investigation has revealed the attack was not limited to cryptocurrency wallet hijacking.
Researchers found the malicious packages were primarily focused on stealing developer credentials and secrets from compromised environments. Targets included:
• npm authentication tokens
• GitHub personal access tokens
• CI/CD pipeline secrets
• Cloud credentials and environment variables
The malware exfiltrated stolen data to attacker-controlled infrastructure and, in some cases, automatically modified GitHub repositories to create public backups of stolen secrets.
Security researchers now believe the attackers were attempting to compromise software supply chains at scale by targeting developer workstations and build environments rather than individual end users.
This shifts the incident from a cryptocurrency-focused attack to a broader software supply chain compromise capable of impacting downstream organizations that rely on affected development environments.
Organizations should assume any development system that installed the malicious packages may have experienced credential exposure and should immediately rotate secrets, review repository activity, and audit CI/CD pipelines for unauthorized changes.
⚠️ Update – Worm-like Propagation Discovered
New research shows this attack behaves like a worm inside the npm ecosystem.
-
The malicious code scans for npm tokens on developer machines and CI/CD pipelines.
-
It can re-publish itself into other npm packages owned by the compromised maintainer.
-
It also steals GitHub tokens, environment variables, and cloud credentials, exfiltrating them to attacker-controlled endpoints.
-
Some victims saw public repos called “Shai-Hulud” created in their GitHub accounts to dump stolen secrets.
This marks the first large-scale self-propagating attack on npm, turning a single compromise into a fast-moving ecosystem threat.
The Malicious Payload
The injected code was designed to:
-
Run in browser environments
-
Intercept cryptocurrency transactions made through popular wallets (MetaMask, Phantom, etc.)
-
Silently redirect payments to attacker-controlled addresses
-
Work across multiple blockchains, including Ethereum, Bitcoin, Solana, Tron, Litecoin, and Bitcoin Cash
This makes it one of the most stealthy and potentially financially damaging supply chain compromises we’ve seen in recent years.
Who Is Impacted
-
Developers & SaaS providers: May have already pulled compromised versions into builds.
-
MSPs & integrators: Risk if Node.js dependencies are in use within hosted services.
-
Fintech & crypto apps: Highest risk, as the payload directly targets wallet transactions.
-
Most SMB end-users: Lower risk unless they build or maintain Node.js apps.
Are OpenText Products Affected?
OpenText Cybersecurity products are not affected.
Our solutions do not rely on these npm packages. The risk lies primarily with customers’ own applications, SaaS tools, and integrations that make use of npm libraries.
What You Should Do Now
-
Audit your dependencies: Check for
chalk,debug,ansi-styles, orsimple-swizzle. -
Roll back to safe versions: Revert to known good releases.
-
Rotate secrets: Treat environments that pulled malicious versions as compromised.
-
Lock your dependencies: Use lockfiles or pinned versions to prevent unverified pulls.
-
Use SBOMs: A Software Bill of Materials makes it easier to identify if you are affected.
-
Educate teams: Encourage phishing-resistant MFA for developer accounts and registries.
-
Revoke/rotate any npm or GitHub tokens present in environments that pulled malicious versions
-
Audit for suspicious repos (like Shai-Hulud) or unexpected GitHub Actions workflows
-
Treat CI/CD environments as high-risk if affected packages were installed
Why This Matters
This attack shows how fragile the software supply chain can be:
-
Even tiny utilities like chalk (used just to color console output) can become high-impact attack vectors.
-
Phishing and credential theft remain the easiest path for attackers to compromise trusted infrastructure.
-
Financially motivated groups are increasingly focusing on developer tools as a way to reach downstream targets.
-
It was detected quickly, which limited impact compared to what could have happened if it went unnoticed.
Supply chain compromises like this are likely to increase in frequency and sophistication.
Resources
Bottom Line
If your teams rely on npm, act immediately: audit, roll back, and lock your dependencies. Even small utilities can introduce massive risk when compromised.
This event is a reminder that supply chain and SBOM visibility are now as important as traditional vulnerability management. Attackers will continue to focus on upstream open-source projects because the payoff is so high.
