Wallet-Drainer Campaign Hits Core npm Packages

On September 8, 2025, a supply chain attack compromised 18 widely used npm packages, including chalk, debug, and ansi-styles. The injected code was designed to intercept cryptocurrency transactions in browsers by executing client-side when bundled into web applications, redirecting payment destinations to attacker-controlled addresses.

The campaign expanded on September 9, 2025, when the duckdb_admin account was breached and DuckDB-related packages were published with the same wallet-drainer malware. While no Vercel customers were impacted by the DuckDB incident, the company continues to collaborate with partners to track activity across the npm ecosystem.

Scope and Impact

Vercel's incident response identified 70 teams with builds containing compromised package versions across 76 unique projects. The malicious code activated when bundled into client-side applications, intercepting cryptocurrency and web3 wallet interactions.

The attack originated from a phishing campaign targeting npm package maintainers. The attacker registered the domain npmjs.help, which has since been taken down, and used it to harvest credentials through fraudulent two-factor authentication update emails.

The phishing email fabricated urgency by imposing a 48-hour deadline, claiming account lockouts would begin September 10, 2025. Package authors are advised to verify any security-related correspondence by navigating directly to npmjs.com rather than following email links.

Response and Mitigation

Vercel's security and engineering teams used the deployment dependency tracking system to identify all affected projects, then purged build caches for all 76 unique affected projects to prevent malicious code from being served. Affected customers received notifications listing the specific projects requiring rebuilds.

The malicious package versions have been removed from npm. Projects rebuilt after the cache purge now use clean package versions. No Vercel customers were affected by the DuckDB compromise, but monitoring remains active across the ecosystem.

Timeline of Events

  • Initial reports surfaced of malicious activity in npm packages
  • 17:39 UTC — Vercel activated incident response
  • 22:19 UTC — Build caches purged for all affected projects
  • September 9, 2025 — Campaign extended to DuckDB-related packages

For teams whose projects appeared in the notification email, rebuilding those projects is the first priority. Projects should be checked against the impacted dependency versions, and dependency update practices reviewed. Vercel recommends package version pinning for defense-in-depth.

All npm consumers should take immediate steps to secure their environments:

  • Run npm audit to check for known vulnerabilities
  • Implement dependency scanning in CI/CD pipelines
  • Use npm ci with lockfiles in production builds
  • Enable npm package provenance where available

Ongoing Prevention Efforts

The company has enhanced monitoring for suspicious package updates and improved tooling for rapid cache invalidation during incidents. The assessment is that upstream compromises of this nature cannot be entirely prevented, but impact can be minimized through rapid detection and response infrastructure.

Credit goes to Aikido Security for early detection and to the npm community for coordinated remediation of the compromised packages. Further analysis can be found in the GitHub Advisory Database, the Socket Security analysis of the qik compromise, the Socket Security analysis of the DuckDB incident, and the Aikido blog post.

For questions about this incident, contact [email protected].