Yesterday, the world of cryptography had a serious fear. A safety violation in a widely used set of developer tools has sent a wave of panic on social networks, with urgent warnings telling everyone to stop making transactions for a while. It was a few hours stretching.
The problem started when Aikido researchers, a security company, spotted something wrong. They found that 18 different packages on NPM – a crucial repository for the code that the developers use – had been infected with malicious code. They were not obscure tools. We are talking about incredibly common packages with names like “Chalk” and “Debug-Js”.
How a phishing email triggered chaos
The developer who maintains these packages, known online under the name of Qix, quickly confirmed the violation. He had been deceived by a phishing email which, in his words, “looked very legitimate”. This only email was everything it took to grant an access to an attacker. The code that was slipped was designed to be sneaky. He would discreetly intercept the activity in the browser of a user linked to the crypto, then rewritten the details of the transaction to send funds to the addresses controlled by the attacker. To make the false addresses less obvious, the code even used a specific algorithm for choosing those that seemed visually similar to the real ones. It was a sophisticated approach, similar to the poisoning scams to which we have already seen.
A major alert with minimum losses
In theory, it should have been a complete disaster. The Security Alliance, a blockchain security group, later noted that these compromised packages see “more than 2 billion downloads per week”. They potentially called it the largest attack on the supply chain of all time. Warnings flying around this fear. But then a strange thing happened. Almost no money has been stolen.
For what? Some factors combined to create what Samczsun of security of security called a “generational escape” by the attacker. On the one hand, the malicious versions of the packages were only live for about two and a half hours. In addition, as the pseudonym developer stressed behind Defilma, 0xngmi, the most serious software projects “pin” their dependencies. This means that they do not automatically use the last update; They stick to a known and safe version. So, even if an update was pushed, many sites still executed the old clean code.
The sequelae: relief and ridiculous
Once the immediate danger is passing through, the atmosphere went from panic to, well, to mockery. The data on the channel revealed that the main address of the attacker held just over $ 900, with a total of approximately five hundred eth eth. Someone even sent a transaction with a message in the data field calling for the pirate of “bloody fool” and “driest” (sic) for having managed to perform such a widespread hacking but not to steal everything that is significant.
But the safety community does not really laugh. Their dominant feeling seems to be that we were all lucky. The concern is now that this unsuccessful attempt essentially provides a plan so that someone else can try again, but more effectively next time. The real cost, as security noted, was noted, was not in lost funds, but in the countless hours, the engineering teams spent to respond. It serves as a austere reminder, and perhaps 免费, the fragile connections that maintain the digital world together.
Publication views: 219
