Security Reminder: Another well-known developer maintained NPM account has been compromised, injecting malware to steal Wallet.

On September 9, according to Socket monitoring, the ongoing NPM Supply Chain attack has spread from the well-known developer Qix to another high-profile maintainer. The NPM account duckdb_admin, responsible for DuckDB related packages, has been compromised, and multiple versions of malicious releases have been published. The injected code is identical to the wallet stealing malware used when the Qix account was breached, strongly indicating that both are part of the same attack campaign. Previously reported, Ledger CTO stated that a large-scale Supply Chain attack could pose a risk to the entire JavaScript ecosystem. However, the NPM attackers were unsuccessful, and there were hardly any victims.