According to CertiK Alert, developer Qix's NPM account was targeted by a phishing attack, with the attacker injecting malicious code into NPM. According to Security Alliance, the attacker appears to have only profited approximately $0.05 in ETH and $20 in Meme coins.

Earlier news, Ledger CTO Charles Guillemet wrote, "A large-scale supply chain attack is currently underway: the NPM account of a well-known developer has been compromised. The affected packages have been downloaded more than 1 billion times, which means that the entire JavaScript ecosystem may be at risk. The malicious code works by silently tampering with cryptocurrency addresses in the background to steal funds."