供应链攻击警报：恶意JavaScript软件包有风险的加密用户

复杂的供应链攻击是通过受损的JavaScript软件包来针对加密用户。了解如何保护您的资产。

Hold on to your hats, crypto enthusiasts! There's some serious cyber-shenanigans afoot. A massive supply chain attack is targeting crypto users, and it's all happening through something you might not even think twice about: JavaScript packages.

抓住您的帽子，加密爱好者！有一些严重的网络 - 阳离子。大规模的供应链攻击是针对加密用户的，这一切都是通过您甚至可能三思而后行的事情发生的：JavaScript软件包。

The JavaScript Package Threat

JavaScript软件包威胁

Here's the deal: Hackers are infiltrating widely-used JavaScript packages, the kind that developers rely on every day. These packages are then injected with malware designed to steal your precious crypto. We're talking about fundamental tools like "chalk," "debug," and "ansi-styles" – packages with billions of weekly downloads. This means virtually the entire JavaScript ecosystem is potentially affected.

这就是交易：黑客正在渗透广泛使用的JavaScript软件包，这是开发人员每天依靠的。然后将这些包裹注入旨在窃取您珍贵加密货币的恶意软件。我们正在谈论的是基本工具，例如“粉笔”，“调试”和“ ANSI风格” - 每周下载数十亿个包装。这实际上意味着整个JavaScript生态系统可能受到影响。

How the Attack Works

攻击的工作方式

The malicious code acts like a silent eavesdropper, monitoring network traffic for crypto transactions across major blockchains like Ethereum, Bitcoin, Solana, and more. When you go to send crypto, the malware sneakily swaps out the destination wallet address with one controlled by the attackers before you even sign the transaction. Sneaky, right?

恶意代码的作用像是一个无声的窃听器，监视网络流量，以在以太坊，比特币，索拉纳等主要区块链等主要区块链中进行加密交易。当您发送加密货币时，恶意软件偷偷地用攻击者控制的目标钱包地址在您签署交易之前。偷偷摸摸，对吧？

What Makes This Attack So Dangerous?

是什么使这次攻击如此危险？

According to Aikido Security researcher Charlie Eriksen, this attack operates on multiple levels:

据Aikido安全研究员查理·埃里克森（Charlie Eriksen）称，这次攻击在多个层面上运作：

• Altering content shown on websites
• Tampering with API calls
• Manipulating what users’ apps believe they are signing

This multi-layered approach makes it incredibly difficult to detect.

这种多层方法使检测到非常困难。

Who's at Risk?

谁有危险？

Ledger CTO Charles Guillemet warns that the entire JavaScript ecosystem could be compromised due to these massive download figures. If you're using a hardware wallet and diligently verify transaction details before signing, you're in a better position. However, software wallet users face a much higher risk.

Ledger CTO Charles Guillemet警告说，由于这些庞大的下载数字，整个JavaScript生态系统可能会损害。如果您使用硬件钱包并在签名之前勤奋地验证交易详细信息，那么您的位置更好。但是，软件钱包用户面临的风险要高得多。

What Can You Do?

你能做什么？

Guillemet's advice is stark: "If you don’t use a hardware wallet, refrain from making any on-chain transactions for now.” He also notes it's uncertain whether attackers can directly extract seed phrases from software wallets.

Guillemet的建议很鲜明：“如果您不使用硬件钱包，请避免进行任何链交易。”他还指出，不确定攻击者是否可以直接从软件钱包中提取种子短语。

A Sophisticated Attack

一项复杂的攻击

This isn't some amateur operation. It's a sophisticated supply chain attack, where criminals compromise trusted development infrastructure to reach a massive number of end users. By infiltrating packages downloaded billions of times a week, attackers gain unprecedented access to cryptocurrency applications and wallet interfaces.

这不是业余操作。这是一种复杂的供应链攻击，犯罪分子妥协了可信赖的开发基础设施，以吸引大量最终用户。通过每周下载数十亿次下载的软件包，攻击者可以实现对加密货币应用程序和钱包接口的前所未有的访问。

Looking Back: Similar Attacks

回顾：类似的攻击

This isn't the first time we've seen JavaScript library compromises. Remember the July attack on "eslint-config-prettier" (30 million weekly downloads) or the March compromises affecting ten popular NPM libraries? It seems like these attacks are becoming more frequent.

这不是我们第一次看到JavaScript库妥协。还记得7月对“ Eslint-Config-Prettier”（每周下载3000万）的攻击，还是影响十个受欢迎的NPM图书馆的三月妥协？似乎这些攻击变得越来越频繁。

My Take

我的看法

This supply chain attack is a serious wake-up call. It highlights the importance of security best practices, not just for developers but for all crypto users. We need better tools and processes to verify the integrity of the software we rely on. Perhaps it's time for more robust auditing and security checks for widely-used JavaScript packages.

这种供应链攻击是一个严重的警钟。它突出了安全最佳实践的重要性，不仅对开发人员，而且对所有加密用户。我们需要更好的工具和流程来验证我们依赖的软件的完整性。也许是时候对广泛使用的JavaScript软件包进行更强大的审计和安全检查了。

The Bottom Line

底线

Stay vigilant, folks! Double-check those transaction details, consider using a hardware wallet, and keep an eye out for any suspicious activity. In the wild west of crypto, a little paranoia can go a long way.

伙计们保持警惕！仔细检查这些交易详细信息，考虑使用硬件钱包，并留意任何可疑活动。在加密西部的野外，一点偏执狂可以走很长一段路。