🚨 Bitcoin Wallets & the NPM Supply Chain Attack: What You Need to Know
If you’ve seen panic headlines flying around, you’re not alone. A major supply chain attack just hit the JavaScript/NPM ecosystem, and it could affect wallets or apps that rely on NPM packages.
The short version:
• A popular NPM developer’s account was compromised.
• Malicious code was slipped into dozens of core libraries with over a billion weekly downloads.
• This malware silently swaps your Bitcoin address with one controlled by the attacker, and it’s smart enough to make the fake address look almost identical to yours.
👉 That’s why you should double-check every single character of the address you see before signing or sending funds.
⸻
🧨 Why This Matters for Bitcoiners
Even though this started in the “developer world,” Bitcoiners aren’t immune. Many wallets and companion apps are written in JavaScript and pull dependencies from NPM. That’s where the risk lies.
Some hardware wallets are fine — as long as you verify the receiving address on the device screen itself. But if the companion software is compromised, it could trick you into approving a transaction you didn’t intend.
This attack is nasty because it doesn’t just swap in any random scam address. It uses an algorithm to pick an address that looks visually similar to your real one. Blink, and you won’t notice the difference.
⸻
🛑 Don’t Panic. Do This Instead:
1. If you’re not making an on-chain transaction right now, relax. You’re safe.
2. Never sign blindly. Always verify the address on your hardware wallet screen, not just the software.
3. Use unaffected wallets (see list below).
4. If you must transact urgently, consider using Sparrow Wallet, which doesn’t rely on NPM/JavaScript.
⸻
✅ Confirmed Unaffected by the NPM Attack
These wallets and apps are not impacted:
• Cove Wallet
• Nunchuk
• Aqua
• Blockstream
• Sparrow Wallet
• Wasabi Wallet
• COLDCARD
• Specter Wallet
• Electrum
• Foundation Devices
• Krux
• SeedSigner
• Bitcoin Keeper
👉 Special mention: Bull Bitcoin Wallet confirmed they’re unaffected since they use Rust and Dart-Flutter libraries instead of JavaScript, backed by an active dev team that takes open source security seriously.
⸻
🟢 Blockstream App & Jade Statement
Good news for Jade users:
• Blockstream Jade is unaffected by the NPM supply chain attack.
• Always confirm the exact send and receive address on your Jade screen before approving any transaction to avoid risks from address-swapping malware.
• The Blockstream App does not use JavaScript or NPM.
• It is built in:
• Swift for iOS
• Kotlin for Android
• C++ and QML for desktop (Qt)
👉 That means both the Blockstream app and Blockstream Jade are unaffected by the ongoing NPM JavaScript attack.
⸻
⚡ Bottom Line
• If your wallet relies on NPM/JavaScript → proceed with caution.
• If your wallet is on the confirmed safe list → you’re fine, but still verify addresses before signing.
• If in doubt → use Sparrow, Wasabi, or a hardware wallet with an independent screen.
Bitcoin is about don’t trust, verify. Today, that means literally verifying your addresses character by character.
Stay sovereign. Stay safe.
