There's been a supply chain attack on NPM but it looks a bit dumb:
https://www.theregister.com/2025/09/08/dev_falls_for_phishing_email/
Apparently you can run this in an NPM project directory to check if you're affected (you must install ripgrep first - all this is doing is searching files for a hex value found in the malware):
rg -uu --max-columns=80 --glob '*.js' _0x112fa8
Source: https://github.com/chalk/chalk/issues/656#issuecomment-3266880534
The malware looks a bit dumb. I think it only works in a browser. If I understand it right, a dev would need to install one of the infected packages, then bundle that into their front-end or browser extension, which would then have to be published and downloaded by users. Then a user would access that front-end or use that browser extension on their own machine. Then if that user tries to initiate a crypto transaction, in a browser tab where the compromised JS is running, the compromised JS will try to intercept that transaction and redirect it towards an address owned by the attackers.
