Ledger CTO: NPM attackers failed, with almost no victims

BlockBeats News, on September 9, Ledger Chief Technology Officer Charles Guillemet issued an update saying, "The latest progress of NPM attacks: Fortunately, the attack failed and there were almost no victims. The attack began with a phishing email disguised as a npm support domain name, stealing user credentials, allowing the attacker to publish malware package updates. The injected code targets network encryption activities, hacks into chains such as Ethereum and Solana, hijacks transactions, and replaces wallet addresses directly in the network response. The attacker's mistakes resulted in CI/CD Pipeline crashes, enabling early detection, with limited impact. Nevertheless, it's a clear reminder: If your funds are stored in a software wallet or exchange, you can lose everything with just one code execution. Supply chain attacks are still a powerful avenue of malware spread, and we're also seeing more and more targeted attacks appear. Hardware wallets are designed to defend against such threats. Features like Clear Signature allow you to accurately confirm transaction content, while Transaction Checking can mark suspicious activity before problems occur. The danger in front of us may have passed, but the threat remains. Stay safe. ”BlockBeats reported earlier today that a large-scale supply chain attack is happening: a well-known developer’s NPM account was hacked. The affected package downloads have exceeded 1 billion times, which means the entire JavaScript ecosystem may be at risk.