# it somehow got worse

Source: https://www.youtube.com/watch?v=Rv9q6kW1vOg
Recap page: https://rapidrecap.app/video/Rv9q6kW1vOg
Generated: 2025-09-10T20:40:30.084+00:00

---
## Quick Overview

A sophisticated supply chain attack targeting the npm ecosystem compromised popular packages like 'debug' and 'chalk', injecting malicious code that steals cryptocurrency wallet addresses and aims to swap destination addresses in transactions. The attack, which likely began with a phishing email, went unnoticed for some time, impacting hundreds of millions of downloads and potentially exposing numerous projects and users. The scale and stealth of the attack highlight significant vulnerabilities in the open-source software supply chain.

**Key Points:**
- The npm 'debug' and 'chalk' packages were compromised by a supply chain attack, injecting a crypto-stealing malware.
- The malware intercepts Ethereum and Solana transactions, swapping the user's intended destination address with the attacker's.
- The attack was initiated via a phishing email, leading to the compromise of package maintainer accounts.
- The malicious code remained undetected for a period, affecting packages with hundreds of millions of downloads.
- The attacker stole approximately 5 cents of ETH and $20 USD worth of a meme coin, but the true financial impact lies in the potential for widespread compromise and disruption.
- The attack highlights the critical importance of supply chain security and vigilance within the open-source software development community.
- The malware uses Levenshtein distance to calculate the closest Ethereum address, making the swap appear legitimate.

![Screenshot at 00:43: The screenshot shows a Hacker News post detailing the npm 'debug' and 'chalk' package compromise, including the initial report of being 'pwned' and a list of affected packages, illustrating the core event discussed in the video.](https://ss.rapidrecap.app/screens/Rv9q6kW1vOg/00-00-43.png)

**Context:** The video discusses a significant supply chain attack that recently affected the npm JavaScript package registry. Attackers compromised popular packages such as 'debug' and 'chalk', which are widely used in the Node.js ecosystem. The attack involved injecting malicious code designed to steal cryptocurrency and manipulate transactions, posing a severe risk to users and projects relying on these packages. The incident underscores the ongoing challenges in securing the software supply chain.

## Detailed Analysis

A sophisticated supply chain attack has compromised widely used npm packages, 'debug' and 'chalk', leading to the injection of malicious code. This malware targets cryptocurrency transactions, specifically intercepting Ethereum and Solana requests. It aims to swap the user's intended destination address with the attacker's by using the Levenshtein distance algorithm to find the closest matching address. The attack likely originated from a phishing email that compromised maintainer accounts. The compromised code was published in updated versions of the packages, which have a massive number of downloads (billions for 'debug', hundreds of millions for 'chalk'), making this one of the largest supply chain attacks in history. While the direct financial theft reported is minimal (around 5 cents of ETH and $20 of a meme coin), the potential impact is vast, including the compromise of numerous projects, potential theft of sensitive information, and the significant effort required for remediation. The attack highlights the vulnerabilities inherent in the open-source software ecosystem and the critical need for enhanced security measures.

### Attack Vector

- Phishing email leading to npm account compromise
- Malicious code injected into 'debug' and 'chalk' packages
- Malware targets Ethereum and Solana transactions

### Malware Functionality

- Crypto-stealing malware
- Swaps user's destination address with attacker's
- Uses Levenshtein distance for address matching

### Impact

- Compromised packages with billions of downloads
- Potential exposure of numerous projects and users
- Minimal direct financial theft reported, but significant potential for wider damage
- Highlights critical supply chain vulnerabilities

### Discovery

- Initial build failure ('ReferenceError: fetch is not defined') led to investigation
- Malware found embedded in package code

### Remediation Steps

- Check 'node_modules' for suspicious files
- Run specific scripts to detect malware
- Verify package integrity

![Screenshot at 00:43: Screenshot of a Hacker News post detailing the compromise of the 'debug' and 'chalk' npm packages.](https://ss.rapidrecap.app/screens/Rv9q6kW1vOg/00-00-43.png)
![Screenshot at 00:50: Screenshot of the npm page for the 'chalk' package, showing its popularity and version history.](https://ss.rapidrecap.app/screens/Rv9q6kW1vOg/00-00-50.png)
![Screenshot at 01:00: Screenshot of a tweet reporting the npm compromise and the attacker's admission of being 'pwned'.](https://ss.rapidrecap.app/screens/Rv9q6kW1vOg/00-01-00.png)
![Screenshot at 02:11: Code snippet showing the malicious JavaScript code, including obfuscated functions and hex values.](https://ss.rapidrecap.app/screens/Rv9q6kW1vOg/00-02-11.png)
![Screenshot at 02:36: Flowchart illustrating how the malware operates, from checking for Ethereum presence to overriding transaction requests.](https://ss.rapidrecap.app/screens/Rv9q6kW1vOg/00-02-36.png)
![Screenshot at 03:43: Screenshot highlighting the build error 'ReferenceError: fetch is not defined' that initially signaled the attack.](https://ss.rapidrecap.app/screens/Rv9q6kW1vOg/00-03-43.png)
![Screenshot at 04:01: The text 'latest version 1.3.3' is highlighted, showing the version of the compromised package that was pushed.](https://ss.rapidrecap.app/screens/Rv9q6kW1vOg/00-04-01.png)
![Screenshot at 07:06: The title of an article from Security Alliance: 'Oops. No Victims: The Largest Supply Chain Attack Stole 5 Cents'.](https://ss.rapidrecap.app/screens/Rv9q6kW1vOg/00-07-06.png)
![Screenshot at 07:15: The 'Impact' section of the article detailing the minimal direct theft but significant potential indirect impact.](https://ss.rapidrecap.app/screens/Rv9q6kW1vOg/00-07-15.png)
![Screenshot at 08:51: A quote from the video author arguing that package managers are inherently risky and can lead to "dependency hell".](https://ss.rapidrecap.app/screens/Rv9q6kW1vOg/00-08-51.png)