The BIGGEST Software Supply Chain Attack in History - Threat Wire

Quick Overview

The biggest software supply chain attack in history occurred when the NPM debug and chalk packages were compromised, leading to the distribution of malicious code and affecting an average of over 2 billion downloads per week within the JavaScript ecosystem.

Key Points: The largest software supply chain attack occurred on Monday, September 8th, 2025, affecting the NPM package manager. Eighteen popular NPM packages, including 'debug' and 'chalk', were compromised with malicious code. The attack was discovered by the team at Akidoi, who alerted NPM to the compromised packages. The malicious code was designed to intercept API calls and rewrite cryptocurrency transactions. The attacker, Josh Junon (GitHub user 'Right9Ctrl'), gained access through a phishing attack targeting a two-factor authentication reset email. Junon admitted to the attack in a public post, stating he should have paid more attention and intended to clean it up. The compromised packages were removed from NPM, and updates were pushed to remove the malicious code.

Context: On September 8th, 2025, a significant security incident rocked the JavaScript ecosystem when the widely used NPM (Node Package Manager) was targeted in what is considered the largest software supply chain attack to date. The attack involved the compromise of popular packages like 'debug' and 'chalk', which were then used to distribute malicious code to millions of developers worldwide.

Detailed Analysis

On September 8th, 2025, the NPM package manager experienced the largest software supply chain attack in history. Eighteen popular packages, including 'debug' and 'chalk', were compromised with malicious code. This code was designed to intercept API calls and rewrite cryptocurrency transactions, potentially draining users' wallets. The attack was discovered by Akidoi security researchers who quickly alerted NPM. The perpetrator, identified as Josh Junon (GitHub user 'Right9Ctrl'), admitted to the attack via a public post, attributing it to a successful phishing attempt that targeted his two-factor authentication reset email. Junon expressed regret and stated his intention to rectify the situation. Following the discovery, the compromised packages were removed from NPM, and updates were released to clean the malicious code from affected systems. The incident highlights the vulnerabilities inherent in open-source software development and the potential impact of compromised dependencies.