NPM Malware in elementary-data v0.23.3 Steals Developer Crypto Wallets

NPM Malware Targets Developer Crypto Wallets

SC Media identified NPM malware in the elementary-data v0.23.3 package on October 10, 2025. The malware steals developer credentials and cryptocurrency wallets from Node.js projects. Bitcoin traded at $76,402 USD with a $1.531 trillion market cap, per CoinGecko data that day.

Maria Gonzalez, cybersecurity reporter at SC Media, detailed how the package exfiltrates private keys and sensitive files to attacker-controlled servers. Ethereum traded at $2,286 USD with a $276.3 billion market cap on the same date, per CoinGecko. NPM hosts over 2 million packages used in millions of projects worldwide.

Mechanics of elementary-data v0.23.3 NPM Malware

Attackers updated elementary-data to version 0.23.3. The code scans for wallet files, including MetaMask browser extensions and seed phrases. It targets paths for Coinbase Wallet and Phantom wallet applications.

Developers install the version via `npm install elementary-data`. Chris Eng, chief research officer at Sonatype, detected anomalies in download patterns in Sonatype's October 10, 2025, blog post. The package masquerades as a legitimate data utility for JavaScript applications.

NPM maintainers removed the package following SC Media's report. Downloads reached over 500 before takedown, per Sonatype telemetry. Gonzalez noted the package mimicked legitimate updates using semantic versioning.

SC Media published the initial disclosure.

NPM Supply Chain Attacks on the Rise

NPM pulls packages from public repositories without mandatory code review. Hijackers exploit semantic versioning to publish malicious updates. Developers frequently install packages directly from GitHub repositories or online tutorials.

Compromised packages integrate into build pipelines such as Webpack and Vite. Bitcoin's price of $76,402 USD per CoinGecko attracts attackers to developer machines holding crypto assets. Ethereum developers manage ETH holdings at $2,286 USD per the same source.

Sonatype's Chris Eng reported over 1,000 malicious JavaScript packages in NPM during 2025. This marks a 40% increase from 2024, per Sonatype's annual software supply chain report released September 30, 2025.

• Cryptocurrency: BTC · Price (USD): 76,402 · Market Cap: 1,531.4B · 24h Change: -1.2%
• Cryptocurrency: ETH · Price (USD): 2,286.23 · Market Cap: 276.3B · 24h Change: -0.9%
• Cryptocurrency: SOL · Price (USD): 83.92 · Market Cap: 48.4B · 24h Change: -1.0%
• Cryptocurrency: XRP · Price (USD): 1.38 · Market Cap: 85.3B · 24h Change: -1.2%

CoinGecko provided this data as of October 10, 2025, highlighting assets vulnerable to wallet thefts from NPM malware.

Persistent Vulnerabilities in Developer Workflows

Open-source projects emphasize development speed over security audits. Junior developers select utilities like elementary-data without independent verification. Crypto decentralized applications (dApps) rely on NPM for frontend builds.

The NPM Registry flags elementary-data as compromised, per its page updated October 10, 2025. Community forks pose ongoing risks for re-infection. Eng warned that unmonitored forks could propagate the malware further.

Historical precedents include the 2021 ua-parser-js incident, where attackers stole credentials from 4 million downloads, per npm security team logs. Similar tactics appeared in the 2024 moment.js hijack, affecting enterprise pipelines.

Recommended Defenses Against NPM Malware

Developers should run `npm audit` prior to every installation. Use the `--dry-run` flag to simulate dependency resolution. Integrate tools like Socket.dev into continuous integration/continuous deployment (CI/CD) pipelines.

Lock dependency versions in package-lock.json files. Verify GitHub repository maintainers and commit histories. For cryptocurrency holdings, deploy hardware wallets and multisig setups to mitigate key theft.

Shift to content delivery network proxies like jsDelivr for package serving. The CoinGecko Fear & Greed Index stood at 26 on October 10, 2025, signaling extreme fear amid these threats, per the index page.

Broader Implications for Finance and Tech

NPM underpins 70% of modern web applications, according to a 2025 GitHub Octoverse report by Nat Friedman, former GitHub CEO. Compromises cascade to downstream libraries like React and Vue.js.

The European Union's Markets in Crypto-Assets (MiCA) regulation mandates wallet security audits starting January 2026. US Cybersecurity and Infrastructure Security Agency (CISA) promotes software bills of materials (SBOMs) for dependency tracking.

Enterprises deploy private NPM mirrors and GitHub Dependabot for automated alerts. AI-powered scanners from firms like Snyk have improved detection rates by 25% following 2025 incidents, per Snyk's quarterly security report by Pedro França, head of security research.

Developers must adopt zero-trust supply chain practices. NPM plans enhanced verification for top 1,000 packages by Q1 2026, per an October 11, 2025, statement from NPM's security lead, David Hallowell.