MSC-2025-7930

Date: September 9, 2025

This package version was compromised to include malicious code that targets browser-based web3 environments. The injected payload intercepts Ethereum and Solana wallet interactions, redirecting funds and approvals to attacker-controlled addresses. The compromise occurred after a maintainer’s account was accessed via phishing. We recommend removing the affected version from the codebase and using the latest version 1.30.0 Reference: https://www.mend.io/blog/npm-supply-chain-attack-infiltrates-popular-packages/

Language: JS