Crypto-stealing code found in 18 npm packages representing more than 2 billion weekly downloads

Malicious releases targeted wallet activity

On September 8, 2025, Aikido’s intelligence feed detected malicious versions of 18 npm packages. The list included widely used dependencies such as debug, chalk, and ansi-styles. Aikido reported that these package names together had more than two billion weekly downloads.

The injected code was designed to run in a website’s browser. Aikido’s original analysis says it watched for crypto and Web3 activity, manipulated wallet interactions, and could rewrite payment destinations so funds or approvals went to attacker-controlled accounts. This was a browser-side crypto theft technique, not the credential-harvesting worm seen in the later Shai-Hulud campaign.

The download number measures the packages’ combined weekly popularity. It is not a count of users who installed the affected versions, and the report does not establish that every downloader was exposed or that funds were taken in every instance.

Check what changed in the browser bundle

Popular utility packages often arrive as transitive dependencies, so a compromised update can enter an application without a developer explicitly adding a wallet-related tool. Applications that connect to wallets should pay particular attention to unexpected changes in frontend dependencies.

• Pin dependency versions and review lockfile changes after a package update
• Inspect browser bundles for unexpected wallet or transaction-handling code
• Keep transaction destinations visible and verify them before signing