npm debug and chalk packages compromised

Aikido's intel feed alerted the company on September 8 at 13:16 UTC to a series of npm package releases containing malicious code, including 18 popular packages such as debug, chalk, ansi-styles and is-arrayish, which together have more than 2 billion downloads per week. The article says the modified versions include a script that runs in website visitors' browsers, silently intercepts crypto and web3 activity, manipulates wallet interactions, and rewrites payment destinations so funds and approvals go to attacker-controlled accounts. Aikido's deobfuscation of the is-arrayish index.js file shows code that checks for window.ethereum and contains many hardcoded Bitcoin and Ethereum addresses.