PANews reported on September 9th that Ledger CTO Charles Guillemet released an update on the NPM attack: "The attack failed, causing almost no losses to the victims. The attacker stole user credentials through a phishing email from a fake npm-supported domain and then released a malicious package update. The injected code targeted web encryption activities, invaded blockchain networks such as Ethereum and Solana, hijacked transactions, and directly replaced wallet addresses in network responses. Due to an attacker's operational error, the CI/CD process collapsed, allowing the attack to be discovered early and the impact to be limited. However, this is still a clear warning: if funds are stored in software wallets or exchanges, a single code execution can result in the loss of all funds. Supply chain security vulnerabilities remain a key vector for malware distribution, and targeted attacks are increasing. Hardware wallets are designed to protect against such threats. Features such as clear signatures confirm transaction details, and transaction checks can flag suspicious activity in advance. Although the current danger has passed, the threat still exists, so it is important to remain vigilant and ensure safety."PANews reported on September 9th that Ledger CTO Charles Guillemet released an update on the NPM attack: "The attack failed, causing almost no losses to the victims. The attacker stole user credentials through a phishing email from a fake npm-supported domain and then released a malicious package update. The injected code targeted web encryption activities, invaded blockchain networks such as Ethereum and Solana, hijacked transactions, and directly replaced wallet addresses in network responses. Due to an attacker's operational error, the CI/CD process collapsed, allowing the attack to be discovered early and the impact to be limited. However, this is still a clear warning: if funds are stored in software wallets or exchanges, a single code execution can result in the loss of all funds. Supply chain security vulnerabilities remain a key vector for malware distribution, and targeted attacks are increasing. Hardware wallets are designed to protect against such threats. Features such as clear signatures confirm transaction details, and transaction checks can flag suspicious activity in advance. Although the current danger has passed, the threat still exists, so it is important to remain vigilant and ensure safety."

Ledger CTO: NPM attackers failed, with few victims

2025/09/09 18:14

PANews reported on September 9th that Ledger CTO Charles Guillemet released an update on the NPM attack: "The attack failed, causing almost no losses to the victims. The attacker stole user credentials through a phishing email from a fake npm-supported domain and then released a malicious package update. The injected code targeted web encryption activities, invaded blockchain networks such as Ethereum and Solana, hijacked transactions, and directly replaced wallet addresses in network responses. Due to an attacker's operational error, the CI/CD process collapsed, allowing the attack to be discovered early and the impact to be limited. However, this is still a clear warning: if funds are stored in software wallets or exchanges, a single code execution can result in the loss of all funds. Supply chain security vulnerabilities remain a key vector for malware distribution, and targeted attacks are increasing. Hardware wallets are designed to protect against such threats. Features such as clear signatures confirm transaction details, and transaction checks can flag suspicious activity in advance. Although the current danger has passed, the threat still exists, so it is important to remain vigilant and ensure safety."

Market Opportunity
Everclear Logo
Everclear Price(CLEAR)
$0,00498
$0,00498$0,00498
+%2,46
USD
Everclear (CLEAR) Live Price Chart
Disclaimer: The articles reposted on this site are sourced from public platforms and are provided for informational purposes only. They do not necessarily reflect the views of MEXC. All rights remain with the original authors. If you believe any content infringes on third-party rights, please contact [email protected] for removal. MEXC makes no guarantees regarding the accuracy, completeness, or timeliness of the content and is not responsible for any actions taken based on the information provided. The content does not constitute financial, legal, or other professional advice, nor should it be considered a recommendation or endorsement by MEXC.