@n3rd
🔒 Critical Alert: Malicious npm packages are impersonating Hardhat tools to steal private keys and mnemonics.
↪ Over 1,000 downloads of a single fake package, active for over a year.
↪ Data is exfiltrated using hardcoded Ethereum addresses.
Open-source dependency complexity is a hacker’s dream—manual reviews are becoming impossible.
🔧 What You Can Do:
✅ Double-check every dependency.
✅ Use tools to audit npm packages.
✅ Build robust supply chain defenses.
🔗 Read the details: https://thehackernews.com/2025/01/russian-speaking-attackers-target.html
0 reply
1 recast
0 reaction