*HACKERS HIJACK NPM PACKAGES IN WHAT IS BEING CALLED THE LARGEST SUPPLY CHAIN ATTACK IN HISTORY

*IF YOU USE A HARDWARE WALLET, PAY ATTENTION TO EVERY TRANSACTION BEFORE SIGNING

*IF YOU DON'T USE A HARDWARE WALLET, REFRAIN FROM MAKING ANY ON-CHAIN TRANSACTIONS FOR NOW: LEDGER CTO

<@INFINITYHEDGE> ⚠️

*The malicious code only impacts individuals accessing the compromised applications over the web, monitoring for cryptocurrency addresses and transactions that are then redirected to attacker-controlled wallet addresses. This causes the transaction to be hijacked by the attackers rather than being sent to the intended address.

*The malware operates by injecting itself into the web browser, monitoring (potentially all chains) Ethereum, Bitcoin, Solana, Tron, Litecoin, and Bitcoin Cash wallet addresses or transfers. On network responses with crypto transactions, it replaces the destinations with attacker-controlled addresses and hijacks transactions before they're signed.

*What makes it dangerous is that it operates at multiple layers: altering content shown on websites, tampering with API calls, and manipulating what users' apps believe they are signing: bleepingcomputer ⚠️

-------------------------------
Update: All impacted package versions have been taken down by NPM.

*Major projects including Ledger, Rabby, Phantom, Metamask, WalletConnect, Jupiter, Hyperliquid, dYdX, PancakeSwap, Privy, Safe {Wallet} & many others have confirmed they are not using compromised packages and are safe to use. Check project twitter/discord for safety confirmations before interacting.

*Websites still using compromised packages can inject malicious code. Always verify the website is safe and double-check transaction addresses before signing.