Was NPM exploited?

Recent NPM supply chain attacks have sparked a brief panic in the crypto community and increased fear of widespread fund theft. Some dismissed exploitation as a minor, but security experts emphasized it as a wake-up call to developers.

“Nothing Burger” with wake-up call

The first report of a massive JavaScript Node Package Manager (NPM) supply chain attack caused a short but intense period of panic within the crypto community. For hours, the destiny seized the warning and speculated about the widespread theft of the user fund. At the time, Ledger CTO Charles Guillemet advised software wallet users to stop on-chain transactions and hardware wallet users and recheck all transactions.

However, over time, the magnitude of the attacks became more clear. It has become clear that malicious code is highly targeted and the number of affected applications is limited. Notable projects like Uniswap, Metamask, Okx Wallet and Aave are all released statements that confirm that they are not affected.

The widespread lack of damage quickly turned the initial panic into a debate. Some Crypto users have begun to question the severity of the original warning. Some now see it as a vigilante, and even see indirect attacks on software wallets. This perspective, while highlighting authentic vulnerabilities, suggests, may be exaggerated to promote the use of hardware wallets.

While some have branded the damage from the perspective of stolen cryptographic elements as a misuse of “Nothingburger,” some blockchain security experts argue that the incident should serve as a wake-up call for all software developers. These experts agree that the incident examines the security model of hardware wallets, but also warn users of such wallets could lose funds for similar attacks under certain circumstances.

Cartesi co-founder Augusto Teixeira showed this point, saying, “Even hardware wallet users can be affected by such attacks. For example, they use hardware wallets with the help of meta masks without checking the data on the device’s screen.

According to Teixeira, hardware wallets don’t have any important features, such as address books and integration with JSON ABI. This allows users to better understand what they are signing from the device’s screen.

Industry-wide impact and best practices

NPM Incidents raise questions about the security practices used by developers, package managers, and organizations. Some people in the Crypto industry believe that best practices (such as peer reviews, unable to allow developers to push code into production without approval) can minimize the probability of such an attack. Additionally, they argue that developers should update their systems and avoid reusing passwords.

Shahaf Bar-Geffen, co-founder and CEO of COTI, believes package managers like NPM should make the sign-in process even more difficult to become an attacker. He argues that “critical package security frameworks,” potentially overseen by organizations like the OpenJS Foundation, can “require annual third-party audits of packages that exceed the fast download thresholds” “2FA, Scoped API tokens), reproducible builds, and packages that exceed the fast download threshold.” Bar-Geffen believes this layered validation model will help encourage best practices while protecting critical infrastructure.

Cartesi’s solutions architect Carlo Fragni encourages researchers to continue to focus on the channels they use to avoid having to resort to one person (which could benefit) to expose malicious activities. He also advocates that “analyze dependencies and perform due diligence on all dependencies whenever they are updated to a new version.”