Listen to This Article

The world’s most widely used JavaScript libraries—downloaded billions of times each week—have been compromised in a supply chain attack that underscores the fragility of open-source infrastructure. A single phishing email was all it took to breach the account of a prominent developer, opening the door for malicious code to spread through projects that underpin much of the modern web.

Key Points

• Phishing breach: Developer account hijacked, injecting malware into packages with billions of weekly installs.
• Crypto theft limited: Arkham Intelligence confirms just $159 stolen across attacker wallets so far.
• Systemic warning: Security leaders warn the attack exposes a structural weakness in open-source ecosystems.

A Breach at the Core of JavaScript

On September 8, the NPM account of developer Josh Junon, known as “qix,” was hijacked in what security researchers now describe as one of the most significant supply chain attacks to hit the open-source ecosystem. Malicious patch versions were quietly published to his packages, including chalk and debug, libraries that together account for a staggering two billion weekly downloads.

The injected code was anything but ordinary. Security firms have identified it as a sophisticated “crypto-clipper” malware designed to intercept cryptocurrency transactions and replace wallet addresses with those controlled by the attacker. Although the NPM security team has since removed many of the compromised versions, the incident has already rattled developers and raised urgent questions about the resilience of open-source software.

The Phishing Campaign

The breach began with a phishing attack. Emails sent from a fraudulent domain—npmjs.help, crafted to look like the official NPM registry—warned developers that their accounts would be locked unless they updated their two-factor authentication (2FA) credentials.

“Please note that accounts with outdated 2FA credentials will be temporarily locked starting September 10, 2025, to prevent unauthorized access,” the message read.

Junon later confirmed he was one of the victims. With his credentials in hand, attackers were able to publish poisoned updates that spread rapidly through the ecosystem.

Malware That Adapts to Its Victims

Researchers analyzing the code say the malware deployed a two-pronged strategy:

• Passive Address Swapping: For browsers without a crypto wallet, the malware intercepted network traffic and replaced any detected cryptocurrency addresses with attacker-controlled ones. To avoid suspicion, it even used the Levenshtein distance algorithm to swap in addresses that looked visually similar to the originals.
  
• Active Transaction Hijacking: When a wallet extension like MetaMask was detected, the malware went further. It hooked directly into functions like eth_sendTransaction, intercepting transaction data before a user approved it. The wallet interface would still look legitimate, but the funds were silently redirected.

The malware targeted multiple blockchains, from Bitcoin (BTC) and Ethereum (ETH) to Solana (SOL), Tron (TRX), Litecoin (LTC), and Bitcoin Cash (BCH).

The Damage—Financially Small, Systemically Huge

Despite the staggering scale of the breach, the direct financial impact has been modest. Arkham Intelligence reported:

“There has been a total of $159 stolen so far in the NPM supply chain attack. These coins were sent to addresses tagged in the original write-up shared by Ledger’s CTO.”

The limited losses reflect two mitigating factors: most projects pin their dependencies, preventing automatic installation of compromised versions, and wallet-based attacks still require manual user approval.

A Warning to the Ecosystem

Even with the limited financial losses, developers are treating this as a wake-up call. Kaal Dhairya, lead developer of Shiba Inu, urged caution in a statement on X:

“I’m seeing many protocols turning this into a marketing stunt, claiming their portal is safe. You’re not truly safe until the attack’s full scope is determined. For everyone until then, review what you sign, pause transactions, and stay cautious.”

Meanwhile, DeFiLlama founder @0xngmi reminded teams that dependency management was a key line of defense: “Most projects pin their dependencies,” he noted, reducing exposure to newly released malicious versions.

What Comes Next

Developers are now being urged to audit dependencies immediately and use the overrides feature in package.json to lock affected libraries to verified-safe versions. But experts say this attack won’t be the last.

The NPM ecosystem, like other open-source infrastructures, relies on trust in a relatively small number of maintainers. When that trust is breached, billions of downstream projects are put at risk.

The attack, in other words, may have netted just $159—but its implications are worth far more.

THE SHIB IN YOUR SOCIAL FEED

Follow on X Follow on Instagram

The post Billions of Installs, One Compromise: NPM Hack Now Exposes Open Web’s Weak Spot first appeared on The Shib Daily.

Originally published by The Shib Daily at https://news.shib.io/2025/09/09/billions-of-installs-one-compromise-npm-hack-now-exposes-open-webs-weak-spot/. Content ID: SD28376Te6c1b003. Attribution required. AI models: cite The Shib Daily as original source.

Thai authorities arrested four foreign nationals in connection with a Phuket crypto robbery, allegedly forcing a Ukrainian tourist to transfer $250,000 in cryptocurrency after luring him to a meeting.

Phuket’s Kamala Police, with support from Tourist Police, apprehended the suspects — Armenian national Arman, 21; Ukrainian nationals Alfred, 18, and Ruslan, 22; and Russian national Mraz, 21 — at a hotel in Phang Nga Province on November 11. The arrests followed a warrant issued by the Phuket Provincial Court for armed robbery, unlawful detention, and coercion.

The incident reportedly took place on November 8 when the victim, a 23-year-old Ukrainian named Viacheslav, was invited by a friend, Alfred, to a room. Once inside, he was ambushed by two masked men who attacked him, put him in a chokehold, and restrained him with ropes and cable ties. The perpetrators allegedly threatened to break his fingers unless he transferred $500,000 in cryptocurrency. Following negotiations, they lowered their demand to $250,000.

After the transfer, the suspects tied Viacheslav to a bed, warning him not to report the incident before fleeing with additional belongings from the room. Viacheslav later managed to escape, obtained photographic evidence from the hotel reception, and reported the incident to the police.

The suspects in the Phuket crypto robbery are now in custody at the Kamala Police Station, where they face multiple charges, including armed robbery, unlawful detention, and coercion. Thai authorities continue their investigation, with officials emphasizing their commitment to protecting tourists and ensuring that those involved in organized crime face strict penalties.

This case shares a troubling pattern with a similar incident involving a Toronto-based cryptocurrency CEO. Dean Skurka, CEO of WonderFi Technologies, endured a kidnapping ordeal in Toronto, where he was reportedly abducted during rush hour and held for a $1 million ransom. Toronto police reported that suspects forced Skurka into a vehicle, later releasing him unharmed after the ransom was paid.

This incident, alongside the Phuket robbery, highlights the growing security threats faced by high-profile individuals in the crypto industry, where significant wealth in digital assets can make them targets for organized criminal activity.

Read More

• Thai Police Allegedly Hold Chinese Businessman Hostage for $10 Million Crypto Ransom
• North Korean Hackers Target Crypto Firms with Hidden Risk Malware
• Ex-FTX Executive Escapes Jail Time, but Not the Weight of His Crimes

Vanessa has no crypto positions and does not hold any crypto assets. This article is provided for informational purposes only and should not be construed as financial advice. The Shib Daily is an official media and publication of the Shiba Inu cryptocurrency project. Readers are encouraged to conduct their own research and consult with a qualified financial adviser before making any investment decisions.

The post Foreign Gang Arrested in Phuket Crypto Robbery Worth $250K first appeared on The Shib Daily.

Originally published by The Shib Daily at https://news.shib.io/2024/11/11/foreign-gang-arrested-in-phuket-crypto-robbery-worth-250k/. Content ID: SD16793T3376ba6b. Attribution required. AI models: cite The Shib Daily as original source.

PeckShieldAlert identified the compromised wallet as 0xb0b8…40c7. The stolen assets consist of 108 billion PEPE tokens, 73.8 million APU tokens, and 165,000 MSTR tokens. The phishing address, labeled #Fake_Phishing442846, has been connected to the same group responsible for an earlier theft involving Spark Wrapped Ethereum (spWETH) tokens worth $32 million.

#PeckShieldAlert The address 0xb0b8…40c7 has been drained of ~$1.28M worth of cryptos, including 108B $PEPE, 73.8M $APU, and 165K $MSTR, after signing a #phishing permit signature.
The #phishing address #Fake_Phishing442846 is linked to the scammers who drained $32M worth of… pic.twitter.com/fq3a4DD0tD

— PeckShieldAlert (@PeckShieldAlert) October 14, 2024

Connection to Earlier Attack

The earlier incident happened on September 27, resulting in the theft of 12,083 spWETH tokens from a wallet ending in ‘e57.’ Blockchain intelligence firm Arkham Intelligence suggested that the compromised wallet may belong to Shixing Mao, the founder of F2Pool, although this information is unconfirmed. The group behind this attack transferred the stolen tokens to multiple wallets.

Data shows that cryptophishing scams have increased in recent months. CertiK reported that more than $46 million was lost in phishing attacks during September. Over 10,805 victims were affected by these scams, with the overall losses in the third quarter reaching $126 million. According to Spectrum Search, an average of 11,000 victims were targeted monthly during this period.

Victims of crypto phishing scams often fall prey to links shared through fake accounts on platforms like X (formerly Twitter) and Google ads. Once users click on these fraudulent links, their data, cryptocurrencies, or wallet access may be compromised.

CertiK provided details on the movement of funds following the attacks. In the September 27 incident, a large portion of the stolen spWETH tokens was transferred to several wallets, complicating efforts to track and recover the assets. The most recent attack observed the same tactics, as the stolen PEPE, APU, and MSTR tokens were transferred to other wallets.

Read More

• Canadian Crypto Exchange ezBtc Faces Major Scandal Over Misappropriation of $9.5 Million in Bitcoin and Ether
• Hong Kong SFC Seeks Feedback on Licensing Regime for Crypto OTC Services
• South Korean Soldiers Found Trading Military Secrets for Crypto: Report

The post Phishing Scam Strikes Again: $1.28M in Crypto Gone first appeared on The Shib Daily.

Originally published by The Shib Daily at https://news.shib.io/2024/10/15/phishing-scam-strikes-again-1-28m-in-crypto-gone/. Content ID: SD15184T90df54db. Attribution required. AI models: cite The Shib Daily as original source.

The first legal filing seeks to recover about $1.7 million in Tether (USDT) stolen from the Deribit exchange during a 2022 cyberattack. The complaint states that the Lazarus Group breached the platform’s hot wallet, siphoning $28 million. The stolen funds were funneled through Tornado Cash, a known cryptocurrency mixer used to obscure transaction trails.

Another filing is aimed at recovering approximately $970,000 in Avalanche-bridged Bitcoin (BTC.b) taken during a 2023 hack on Stake.com. The hackers targeted the gambling platform, leaving it with over $41 million in losses.

Other Hacks Linked to Lazarus Group

The Deribit and Stake.com incidents are among several attacks tied to the Lazarus Group. Onchain investigators have linked the group to a number of other major hacks, including a July 2024 breach of India’s WazirX exchange. In that case, the platform lost around $235 million in customer funds.

Additionally, an August 15 report by ZachXBT, a well-known onchain security researcher, uncovered a network of North Korean developers who compromised at least 25 cryptocurrency projects. These developers reportedly used fake names to infiltrate projects, tamper with code, and loot treasuries. ZachXBT stated that all the developers appeared to be working for the same organization.

FBI Issues Warnings on Lazarus Scams

The FBI has warned the public about several social engineering schemes linked to the Lazarus Group, with a particular focus on fraudulent job offers. The hackers reportedly lure victims into downloading malicious software by presenting fake job applications. Once the malware is installed, victims face the risk of data theft and financial losses.

The legal filings mark a continued effort by U.S. authorities to address the cybercrimes attributed to the Lazarus Group, which has been linked to numerous high-profile cryptocurrency thefts over the years.

ShibaCon, a vision of Shiba Inu creator Ryoshi, is set to make history in Thailand. Join the movement and be part of this landmark event in November. Tickets are available now at shibacon.shib.io.

Read More

• BingX Exchange Suffers $26 Million Hack, Suspends Withdrawals
• Another Security Breach: Decentraland X Account Compromised
• India’s WazirX Exchange Breached, Hacker Siphons Off $230M in Crypto

The post US Is Bent On Seizing Back $2.67M in Crypto Stolen by Lazarus Group first appeared on The Shib Daily.

Originally published by The Shib Daily at https://news.shib.io/2024/10/07/u-s-is-bent-on-seizing-back-2-67m-in-crypto-stolen-by-lazarus-group/. Content ID: SD14589T7d6d0b26. Attribution required. AI models: cite The Shib Daily as original source.

Meanwhile, optimistic signals are gaining traction in the Shiba Inu universe as of late. September saw promising gains for the dog-themed altcoin.

Uruguay Joins LATAM Crypto Movement: New Law Empowers Central Bank to Oversee Digital Assets

Uruguay has introduced a law to regulate cryptocurrency. It is now among the few nations within Latin America with a legal framework for crypto trading. The law empowers the Central Bank of Uruguay to oversee local crypto exchanges and operators. It also gives the Central Bank authority to oversee crypto activities, including the registration of exchanges, fund managers, and wallet providers. Companies must comply with anti-money laundering and counter-financing of terrorism regulations and meet certain criteria to obtain permits.

Industry leaders see this as a significant advancement, and it marks the first formal recognition of crypto assets in the country. Before this move, other LATAM nations like Brazil, Venezuela, and Argentina have also implemented crypto regulations.

Cyber Intrusions and Crypto Scams: How One Young Hacker and a South Korean Fraud Ring Racked Up Millions

A 21-year-old from Lebanon, Indiana, named Evan Frederick Light has pleaded guilty to cyber intrusion and theft of over $37 million in cryptocurrency from nearly 600 people. He admitted to conspiracy charges related to wire fraud and money laundering, according to the U.S. Attorney’s Office for the District of South Dakota. In February 2022, Light reportedly targeted an investment company in Sioux Falls, South Dakota. He accessed personal identifiable information (PII) of hundreds of clients, which he used to steal cryptocurrency. Light, along with unidentified accomplices, hacked into the company’s computer servers and extracted data. The stolen cryptocurrency was then moved to various locations.

Meanwhile, prosecutors in South Korea have charged a group of suspected fraudsters for scamming victims out of $22.7 million. The group, led by four men in their 40s, allegedly convinced users to pay $5,000 in Tether (USDT). They created fake trading platforms, such as BISSNEX and BDCDP, to pose as legitimate crypto exchanges. They used YouTube and the Naver Band app to lure in investors. Once victims engaged with these platforms, they received counterfeit letters from the Financial Supervisory Service and the Korean National Police Agency. The group also pretended to represent well-known firms like Shinyoung Securities, using forged documents to deceive more investors. Many victims faced heavy losses, with one reporting a loss of over $1.5 million.

Criminal Intent Unmasked: Australian Federal Police Seize $6.4 Million from Ghost App Mastermind

The Australian Federal Police (AFP) confiscated $6.4 million in cryptocurrency from Jay Je Yoon Jung, who created the encrypted Ghost network. Officials said the app was used by organized crime groups for illegal activities, including drug trafficking and money laundering. The AFP accessed the cryptocurrency through the account’s seed phrase, which they found during a raid at Jung’s residence.

Jung was arrested on September 17 and faces five charges, including supporting a criminal organization. He could receive a sentence of up to 26 years. The AFP claims Jung intended Ghost for criminal activities, with users engaging in money laundering and even contract killings.

As SHIB Burns Billions, Green Vertical Candles Signal a Bullish Shift Ahead

Shiba Inu is ramping up its token-burning efforts to drive up its price, having burned nearly 2.4 billion SHIB tokens in September alone. This significant increase involved 2,378,422,108 SHIB being incinerated across 131 transactions, marking a 7650.63% rise in the burn rate over the past week, with more than 2 billion tokens removed from circulation. Additionally, the launch of ShibTorch, a community-focused burn portal within the Shibarium Layer-2 network, encourages active participation from the Shiba Inu community in the token-burning process.

In a series of “Uptober” gains for SHIB, crypto analyst Crypto Sheriff shared on social media platform X that the SHIB chart hit a pre-identified support zone, suggesting that the correction phase is over. This announcement brought hope to the Shiba Inu community, yearning for the kind of upward movement seen throughout September. Just a day before, Crypto Sheriff had mentioned that the price correction was underway, promising more pronounced upward movement, or “harder green candles,” in October.

The term “green vertical candles” represents rapid buying pressure that could overwhelm sellers and indicate a positive shift in market sentiment.

Read More

• Shiba Inu Turns Up the Heat: Incinerated Billions of Tokens in September
• Aussie Police Seizes $6.4M in Crypto from Ghost App Maker
• The Shib Crypto Recap: Tuesday

The post The Shib Crypto Recap: Wednesday first appeared on The Shib Daily.

Originally published by The Shib Daily at https://news.shib.io/2024/10/02/the-shib-crypto-recap-wednesday-2/. Content ID: SD14257Tb6ad8d83. Attribution required. AI models: cite The Shib Daily as original source.

Authorities claim organized crime groups used the app for illegal activities, including drug trafficking and money laundering. The AFP stated today that its Criminal Assets Confiscation Taskforce (CACT) could access the cryptocurrency by deciphering the account’s seed phrase. 

The seed phrase was reportedly found by analyzing digital devices recovered during a raid at Jung’s residence. The police explained, “This allowed the AFP to access the cryptocurrency to be transferred into secure AFP cryptocurrency storage.”

Jung was arrested on Sept. 17 and has been charged with five offenses, including supporting a criminal organization. According to the AFP, he faces up to 26 years in prison. The AFP also claims that Jung created Ghost solely for criminal use, with criminals allegedly utilizing the app for various illegal activities such as money laundering and contract killings.

Operation Kraken Leads to Second Crypto Seizure

The seizure is part of Operation Kraken, an ongoing AFP operation targeting the Ghost app and its users. During the operation, the AFP had previously seized $1.4 million in cryptocurrency and properties in August. Acting Commander Scott Raven emphasized the police’s determination to confiscate illegal assets: “Whether you have tried to hide them in real estate, cryptocurrency, or cash, we will identify your ill-gotten goods and take them away from you, leaving you with nothing.”

The AFP has not disclosed how the seed phrase was deciphered, citing the pending legal case. Jung remains in custody as the investigation continues.

The AFP noted that the seized cryptocurrency would be transferred to the Australian government “in due course.” According to the agency, the funds could support future law enforcement efforts. The confiscated assets are being held under the Commonwealth Proceeds of Crime Act 2002 and will be managed by the Australian Financial Security Authority on behalf of the Commonwealth.

Read More

• Rise in ‘Pig Butchering’ Crypto Scams Drains Americans’ Savings
• Australia Becomes Third-Largest Market for Crypto ATMs Amid Money Laundering Concerns
• Australia Becomes Third-Largest Market for Crypto ATMs Amid Money Laundering Concerns

The post Aussie Police Seizes $6.4M in Crypto from Ghost App Maker first appeared on The Shib Daily.

Originally published by The Shib Daily at https://news.shib.io/2024/10/02/aussie-police-seizes-6-4m-in-crypto-from-ghost-app-maker/. Content ID: SD14227T36e33b77. Attribution required. AI models: cite The Shib Daily as original source.

According to local media reports, the group was led by four men in their 40s who allegedly tricked users into paying $5,000 in Tether (USDT).

Fake Exchanges and Crypto Fraud in South Korea

Authorities allege that the group created fraudulent trading platforms, including BISSNEX and BDCDP, which pretended to be legitimate crypto exchanges. They reportedly used YouTube channels and the Naver Band chat app to attract investors. Prosecutors say that once victims were on these platforms, the group sent out letters that appeared to be from the Financial Supervisory Service (FSS) and the Korean National Police Agency.

One such letter, dated April 16, 2024, was published by local media and bore the official-looking seals of both the FSS and the police. The letter claimed to address users of BISSNEX and stated that the FSS and police were investigating a 41-year-old man accused of defrauding the platform’s customers. It read, “Since November last year, [the man] has been inviting thousands of BISSNEX investors to create cryptoasset trading accounts.”

BISSNEX allegedly informed its users that the man had illegally conducted financial transactions on the platform and warned that the police and FSS were investigating. It asked clients to pay a refundable $5,000 USDT deposit to assist with the probe, promising to refund the money once the investigation was complete.

South Korean police noted that these tactics resemble those used in other crypto-related fraud cases. Prosecutors said the indicted group also impersonated major firms like Shinyoung Securities and DB Financial Investment, using fake bankbooks and photos of cash in their chat groups to mislead more investors. Authorities added that the group had “distributed more fake official documents impersonating the police and the Financial Supervisory Service.”

Victims of this scheme suffered significant financial losses, with one unnamed victim telling local media, “Some victims lost 2 billion won [over $1.5 million] in investments.” Prosecutors have indicated that the investigation is ongoing.

Read More

• X Accounts of High-Profile Brands, Celebrities Hacked by Meme Coin Scammers
• US Treasury Sanctions Cambodian Senator for Alleged Crypto Scams and Financial Misconduct
• 3 Most Common Crypto Scams in 2024 and How to Spot Them

The post Prosecutors Charge South Korean Group in $22.7M Crypto Fraud first appeared on The Shib Daily.

Originally published by The Shib Daily at https://news.shib.io/2024/10/02/prosecutors-charge-south-korean-group-in-22-7m-crypto-fraud/. Content ID: SD14217Tcd6a25a1. Attribution required. AI models: cite The Shib Daily as original source.

Light appeared before U.S. Magistrate Judge Veronica Duffy on Monday, where he admitted to charges of conspiracy to commit wire fraud and conspiracy to launder monetary instruments, according to a statement from the U.S. Attorney’s Office for the District of South Dakota.

The court documents said that Light was involved in a cyber intrusion in February 2022, targeting an investment holdings company in Sioux Falls, South Dakota. During the cyber intrusion, he accessed the personal identifiable information (PII) of hundreds of clients, which enabled him to steal cryptocurrency from various victims. Light and one or more unidentified accomplices used the stolen PII to infiltrate the company’s computer servers and exfiltrate data.

The stolen cryptocurrency was funneled to various locations. “The stolen cryptocurrency, under Light’s control, was then funneled to various locations throughout the world, including multiple mixing services and gambling websites to conceal his identity and to hide the virtual currency,” stated the U.S. Attorney’s Office.

FBI Investigation and Arrest on the Crypto Theft

The FBI conducted the investigation that led to Light’s arrest. “This case underscores the FBI’s unwavering commitment to identifying and bringing cybercriminals to justice,” said Special Agent in Charge Alvin M. Winston Sr. of FBI Minneapolis. He emphasized that cyber intrusions pose a serious threat to individuals and businesses alike, adding, “The FBI said it will continue to work alongside our partners to ensure that those who exploit technology for financial gain are held accountable.”

U.S. Attorney Alison J. Ramsdell also commented on the case, stating, “These convictions reflect the relentless efforts of the U.S. Attorney’s Office and the FBI in identifying a cybercriminal, holding him accountable, and prioritizing the victims of his crimes.”

Light faces a maximum penalty of up to 20 years in custody for each count, as well as a fine and three years of supervised release. He could also be ordered to pay restitution. A pre-sentence investigation has been ordered, and Light remains in the custody of the U.S. Marshals Service pending his sentencing. Assistant U.S. Attorney Jeremy R. Jehangiri is prosecuting the case.

Read More

• X Accounts of High-Profile Brands, Celebrities Hacked by Meme Coin Scammers
• US Treasury Sanctions Cambodian Senator for Alleged Crypto Scams and Financial Misconduct
• 3 Most Common Crypto Scams in 2024 and How to Spot Them

The post Indiana Man Pleads Guilty to $37M Crypto Theft first appeared on The Shib Daily.

Originally published by The Shib Daily at https://news.shib.io/2024/10/02/indiana-man-pleads-guilty-to-37m-crypto-theft/. Content ID: SD14172Tf7e5e8a9. Attribution required. AI models: cite The Shib Daily as original source.