HARDWARE WALLETS AT RISK

There’s a large-scale supply chain attack in progress: the NPM account of a reputable developer has been compromised. The affected packages have already been downloaded over 1 billion times, meaning the entire JavaScript ecosystem may be at risk.

The malicious payload works by silently swapping crypto addresses on the fly to steal funds.

If you use a hardware wallet, pay attention to every transaction before signing and you're safe.

If you don’t use a hardware wallet, refrain from making any on-chain transactions for now.

It’s still unclear whether the attacker is also stealing seeds from software wallets directly at this stage.