The attack event targeting the NPM Supply Chain has occurred again, with @ctrl/tinycolor releasing a malicious version.

2025-09-16 01:32:37

Abstract generation in progress

PANews reported on September 16 that Scam Sniffer has detected another attack targeting the NPM Supply Chain. A malicious version of @ctrl/tinycolor (which has a weekly download of 2.2 million times) was released, which runs an information-stealing program during the npm postinstall script execution to scan and steal sensitive data. This malicious payload abused the legitimate sensitive information scanning tool TruffleHog. Please check if you have downloaded the affected version, pause installation/updates, and pin the version to a known safe version.

View Original

This page may contain third-party content, which is provided for information purposes only (not representations/warranties) and should not be considered as an endorsement of its views by Gate, nor as financial or professional advice. See Disclaimer for details.

4 Likes