Lars WillighagenSep 8
amos
The 'color' npm package has been compromised: https://fasterthanli.me/articles/color-npm-package-compromised
color npm package compromised

Note: the situation is still unfolding, I’ll update this article as more comes in. On September 8 2025, around 13:00 UTC, someone compromised Josh Junon’s npm account (qix) and started publishing b...

fasterthanli.me
Sep 8 at 5:00pmWeb
Show threadamosSep 8
I'm currently going through the NPM attack payload and learning a bunch of about cryptocurrency (I've been ignoring them completely this whole time)
Show threadamosSep 8

try {
args = JSON.parse(JSON.stringify(argsIn));
} catch (e) {
args = [...argsIn];
}

Ah see? I'm not the only one who didn't know about structuredClone

Show threadamosSep 8

Here's the NPM supply chain attack payload deobfuscated & cleaned up by hand as best I could: https://github.com/fasterthanlime/0x112

...I'm not sure it would ever work in its current form, tbh

GitHub - fasterthanlime/0x112: De-obfuscated payload from the September 8 2025 npm supply chain attack

De-obfuscated payload from the September 8 2025 npm supply chain attack - fasterthanlime/0x112

GitHub
Show threadExa Sep 8
@fasterthanlime Checked etherscan and apart from the main address there is this address with a transaction: https://etherscan.io/address/0xa4134741a64F882c751110D3E207C51d38f6c756
So I guess this account may be at risk https://etherscan.io/address/0xfaa1da7652cd162ad43bf1459a67df1a05a26a3d (~$300 worth)
Show threadDaniel LuzSep 8
@fasterthanlime …huh, and usable since 2022!? This is pretty cool https://developer.mozilla.org/en-US/docs/Web/API/Window/structuredClone
Window: structuredClone() method - Web APIs | MDN

The structuredClone() method of the Window interface creates a deep clone of a given value using the structured clone algorithm.

MDN Web Docs
Show threadLars WillighagenSep 8
@fasterthanlime I think I got the same 2FA phishing email!
Show threadLars WillighagenSep 8
@fasterthanlime RE: the unresponsiveness of npm, I noticed that there's not really a way of reporting *failed* phishing attempts mentioned on the site either.
Show threadSimon DassowSep 8
@fasterthanlime Color me surprised 🙄
Show threadraspberryswirlSep 8
@fasterthanlime get more colours in your life 
Show threadAwalrusSep 9
@fasterthanlime unrelated to the malware, but the sponsorship tiers look a bit wonky on Firefox mobile (attached both chrome and Firefox on Android)