Qix phishing shipped wallet drainers

The September 2025 npm phishing wave was ordinary at the front door and enormous behind it. A maintainer received a fake npm support message from npmjs.help, followed the credential-reset flow, and effectively handed attackers publishing access. Within hours, malicious releases appeared under some of the most common JavaScript utility names.

The first public set centered on packages maintained by Josh Junon, including debug, chalk, ansi-regex, strip-ansi, wrap-ansi, and related color and terminal helpers. The packages were small, but their reach was not. Public reporting put their aggregate weekly download volume around two billion, with the malicious versions removed after a short exposure window.

The injected code was aimed at cryptocurrency theft rather than generic host compromise. It hid in client-side bundles, hooked browser and web3 APIs, watched for transaction material across Ethereum, Bitcoin, Solana, Tron, and other chains, and replaced destination addresses with attacker-controlled lookalikes before the user signed. That payload choice made the blast radius more subtle than a server-side credential stealer would have been. A compromised package could be installed in a build environment, bundled into browser code, and only become dangerous when a user later interacted with a wallet or a transaction flow.

Follow-on reporting tied additional package surfaces to the same campaign, including DuckDB packages, Prebid packages, proto-tinker-wc, and @coveops/abi. Those are kept as separate attack records where the maintainer, project, or distribution boundary differs from the original Qix account. This campaign record therefore carries the shared phishing path and wallet-drainer mechanics, while the leaf records preserve the exact package coordinates defenders need for lockfile, cache, mirror, and deployed-bundle searches.