npm just got smoked today. One maintainer clicked a fake login link and suddenly 18 core packages were backdoored. Chalk, debug, ansi styles, strip ansi, all poisoned in real time.
These packages pull billions every week. Now anyone installing fresh got crypto clipper malware bundled in. Your browser wallet looked fine, but the blockchain was lying to you. Hardware wallets were the only thing keeping people safe.
Sir Mike44 JRnotBS ☠🦈🦛🐊🇺🇸
npub16f…mxxv3
2025-09-10 04:45:29 UTC
Author Public Key
npub16fe3neslk7w649nvmpk0kd0kv4qh7u89kkq7gl77sjnd4quzms2szmxxv3Seen on
wss://nostr.momPublished at
2025-09-10 04:45:29 UTCEvent JSON
{
"id": "abb195c756066f19c073011b768bb49894a64612f6b785d7a89b295f93e61462",
"pubkey": "d27319e61fb79daa966cd86cfb35f665417f70e5b581e47fde84a6da8382dc15",
"created_at": 1757479529,
"kind": 1,
"tags": [
[
"proxy",
"https://noauthority.social/users/MSP_SMIMSA/statuses/115178178458602239",
"activitypub"
],
[
"client",
"Mostr",
"31990:6be38f8c63df7dbf84db7ec4a6e6fbbd8d19dca3b980efad18585c46f04b26f9:mostr",
"wss://relay.mostr.pub"
]
],
"content": "npm just got smoked today. One maintainer clicked a fake login link and suddenly 18 core packages were backdoored. Chalk, debug, ansi styles, strip ansi, all poisoned in real time.\n\nThese packages pull billions every week. Now anyone installing fresh got crypto clipper malware bundled in. Your browser wallet looked fine, but the blockchain was lying to you. Hardware wallets were the only thing keeping people safe.",
"sig": "81b80e9a24380f844492f3ce8964046402c1c1e47b166a077c02cef81507d954ef9a8341352269b1c3fb4905de07881231d3b1a15df23ad7345e1b2a45d4deae"
}