Phishing
Security incidents tagged Phishing. Newest first.
0 Phishing incidents in the last 12 months
- Incidents
- 5
- Live
- 0
- Patched
- 5
- Days without an incident
- 405
- Longest quiet run: 581 days (Dec 15–Jul 17)
Show 5 older incidents5 older incidents
September 2025 1
- PatchedSupply chain
chalk, debug and 16 other npm packages (2B+ weekly downloads) hijacked via fake 2FA email
Maintainer Josh Junon (qix) was phished by a fake npm 2FA-reset email from npmjs.help. The attacker published malicious versions of 18 packages, including chalk, debug, ansi-styles and strip-ansi, with code that hijacked crypto wallet transactions in browsers. They were live for about two hours.
npm: chalk, debug, ansi-styles, strip-ansi, supports-color and 13 moreClosed Sep 13, 2025
July 2025 1
Patchedeslint-config-prettier and friends hijacked via npnjs.com phishing (CVE-2025-54313)Supply chain
npm: eslint-config-prettier, eslint-plugin-prettier, synckit, @pkgr/core, napi-postinstall, is
A maintainer was phished through the typosquat domain npnjs.com. The attacker published malicious eslint-config-prettier versions whose install script ran node-gyp.dll on Windows, dropping the Scavenger infostealer. eslint-plugin-prettier, synckit, @pkgr/core, napi-postinstall and later the 'is' package were also hit.
Open incident →CVE-2025-54313
December 2023 1
- PatchedSupply chain
Ledger Connect Kit npm package hijacked to drain crypto wallets
Attackers phished a former Ledger employee's npm account and published malicious @ledgerhq/connect-kit versions 1.1.5 to 1.1.7. Because many dApps load it from a CDN without pinning a version, their users were shown wallet-drainer prompts. Ledger shipped a clean 1.1.8 within about 40 minutes of finding out.
@ledgerhq/connect-kit (npm)Closed Dec 14, 2023
August 2023 1
HighRetool breach: SMS phishing, deepfaked voice call and synced MFA codesBreachesNo fix needed
Retool (cloud) No fix needed
An attacker phished a Retool employee by SMS, then called them with a deepfaked voice to get an MFA code. Because Google Authenticator synced codes to the employee's Google account, the attacker got their MFA codes too, and took over 27 cloud customer accounts, all in crypto.
June 2023 1
HighJumpCloud breached by North Korean hackers to reach crypto customersBreachesNo fix needed
JumpCloud (directory / device management SaaS) No fix needed
A spear-phishing attack let a nation-state actor into JumpCloud's infrastructure. The attacker abused its command framework to target a small set of customers. JumpCloud force-rotated all customer API keys, and researchers tied the attack to North Korea, aimed at crypto companies.
