Microsoft Alerts on npm Malware Targeting Cryptocurrency Wallets

• •Attackers are using compromised npm packages to deploy remote access Trojans.
• •The malware can log keystrokes and steal cryptocurrency wallet credentials.
• •Microsoft urges developers to perform security audits and monitor wallet activity.

Microsoft's Threat Intelligence unit has issued a warning about a cyber campaign targeting cryptocurrency investors and software developers through compromised npm packages. The malware, embedded in two specific packages, acts as a remote access Trojan, capable of logging keystrokes and stealing sensitive wallet credentials. This attack leverages the Hugging Face platform to obscure the data exfiltration process, making detection difficult for conventional security systems. The campaign is part of a broader trend of software supply chain attacks that have recently affected multiple ecosystems, including Python and Rust. Microsoft recommends developers audit their dependencies, remove suspicious packages, and monitor wallet activity to mitigate risks. The threat highlights the evolving tactics of attackers who now focus on development tools rather than just end-user systems. Users are advised against storing sensitive information on connected devices and to verify transactions before approval.