NPM Security Breaches 2025 – The Largest Supply Chain Attacks in History

The attack resulted in the exposure of 2,180 GitHub accounts and 7,200 repositories across three separate attack waves — and the damage is still unfolding.

NPM, the world’s largest software registry with over 17 million developers and 2 million packages, suffered two massive breaches in 2025.

From malware hidden in Nx builds to phishing attacks hijacking popular packages with billions of downloads, these incidents exposed sensitive data, cryptocurrency wallets, and developer credentials across the globe.

In this episode of Technically U, we break down:

✅ The August 2025 “s1ngularity” attack against Nx packages

✅ The September 2025 phishing incident targeting chalk, debug, ansi-styles & more

✅ How attackers targeted cryptocurrency wallets and hijacked transactions

✅ The role of AI tools in reconnaissance and exploitation

✅ The global impact on enterprises like Netflix, Amazon, Shopify, and Spotify

✅ Security measures businesses must take to prevent supply chain compromises

These attacks mark a new era of software supply chain threats—where open-source trust can be weaponized against millions.

🔔 Subscribe to Technically U for more tech dives into cybersecurity, AI, and the future of tech.