# @feross: Major npm supply chain attack hit @ctrl/tinycolor and 40+ packages

Source: https://x.com/feross/status/1967732902256579014
Kiwi News: https://news.kiwistand.com/stories/feross-Major-npm-supply-chain-attack-hit-ctrltinycolor-and-40-packages?index=0x68c9c5ec635118a15770c6350ce31e456481ce5c02dc73595d022c0dbb7f72a0eff2a49d
Submitted by tim on 2025-09-16 UTC, 7 upvotes, 0 comments

🚨 Major active supply chain attack just hit npm.

Popular package @​ctrl/tinycolor was trojanized — and it didn’t stop there. Over 40 packages were silently modified to steal secrets from dev machines & CI pipelines.

Our team at Socket caught it. Full report coming soon. Stay safe out there.