Crims have added backdoors to at least 18 npm packages after developer Josh Junon inadvertently authorized a reset of the two-factor authentication protecting his npm account.

The malware targets cryptocurrency transactions on various blockchains such as Ethereum, Bitcoin, Solana, and Tron.

In posts to Bluesky and GitHub on Monday, Junon acknowledged that a phishing email had duped him, allowing miscreants to take over his account.

"Sorry everyone, I should have paid more attention," Junon wrote. "Not like me; have had a stressful week. Will work to get this cleaned up."

The phishing email came from support@npmjs.help rather than npmjs.com, and several other developers have reported receiving a similar message.

Junon (Qix-) on GitHub has contributed to at least 80 npm packages . He id

See Full Page