npm Package 'color' Compromised: Thousands of Millions of Downloads Affected by Malicious Code

A devastating attack has been launched against the npm package 'color', which has been downloaded millions of times. The malicious code was inserted into the package by an attacker who successfully breached the developer's account through a phishing email. The email, which was sent from a newly registered domain, npmsj.help, claimed to be a 2FA reset email, but was actually a fake. The malicious code is designed to target browser environments, hijacking fetch and XMLHttpRequest requests to replace cryptocurrency addresses with those controlled by the attacker. This allows the attacker to monitor transactions made through MetaMask and other wallets. As of the time of writing, the npm team is working to remove the malicious package, but the response time has been criticized. This attack highlights the importance of secure development practices and the need for developers to be vigilant in protecting their accounts and packages.