Hey everyone
I work in cyber security and today we discovered a massive attack that started 2 hours ago that has a big potential impact for crypto currency investors. This impacts over 2 billion websites / applications

TL;DR: A bunch of very widely used web building blocks (npm packages) were compromised today (Sep 8, ~13:16–15:15 UTC). If a website you visit pulled in one of those bad updates, malicious code could silently change the wallet address you’re paying/approving right in your browser, so your funds or approvals go to an attacker even though the screen looks normal. If you’ve signed anything in the last few hours on web apps, verify transactions/approvals and consider revoking risky approvals.

What happened

• Websites and web apps are built from reusable “lego bricks” of code maintained by others called open source packages. Today, 18 very popular packages got new versions that secretly contained malware. Combined they are downloaded 2 billions times per week.
• If a website happened to auto-update to one of those versions, the malware ran inside visitors’ browsers.
• The malware’s job: watch for crypto activity and quietly swap out wallet addresses (or change “approval” targets) so money/permissions go to the attacker instead of your intended destination.
• It recognizes addresses for multiple chains: Ethereum, Bitcoin (legacy & segwit), Solana, Tron, Litecoin, Bitcoin Cash.

Who is at risk?

• Anyone who used a browser-based wallet (e.g., MetaMask or Solana wallets) on sites/dapps that might’ve auto-pulled those compromised packages during the window.

What you should do right now

• Slow down & verify: Before signing, manually check the recipient address and approval/spender addresses. If something looks off by even one character, don’t sign.
• Use small test sends first when possible.
• Review and revoke approvals you don’t recognize (use a reputable approval manager for your chain).
• Check your recent transactions for unexpected recipients.
• Prefer hardware wallets and carefully inspect on-device prompts—they show the real destination the device will sign for.
• Wait for official notices from the dapps you use confirming they’ve audited/locked deps or rolled back.

For devs/dapp operators (brief)

• Pin/lock dependencies; temporarily disable auto-updates.
• Roll back the affected versions and redeploy.
• Integrity-check your build output and front-end bundles; monitor CDN caches.
• Add client-side allow-lists for RPC/wallet calls and validate transaction params before presenting for signature.

We are updating our blog as we go - https://www.aikido.dev/blog/popular-nx-packages-compromised-on-npm