Today, security researchers uncovered malicious code hidden in a widely used NPM package with tens of millions of weekly downloads.
What does this code do?
It silently swaps out the crypto address you’re sending to, replacing it with the attacker’s address. Instead of reaching your friend or exchange, your funds go straight into a hacker’s wallet.
This is a classic supply chain attack: trusted software is compromised. And the scary part? Even the widely trusted open-source tools can be affected.
For crypto users, that’s a nightmare. You think you’re in control, but in reality, the attack happens behind the scenes.
Why ELLIPAL Users Can Stay Calm
ELLIPAL wallets are designed to remain secure no matter how compromised your phone, computer, or internet connection may be.
Here’s why:
- 4-inch Display → Full transaction details on a big screen, no guessing.
- 100% Offline Signing → Signatures happen only inside the wallet, never online.
- You Are in Control → Verify with your own eyes before signing.
That’s why this NPM attack does not affect ELLIPAL users.
The Power of Clear Signing
This attack is a strong reminder: always check your transactions on your hardware wallet’s screen.
With Clear Signing, you see:
- The recipient address
- The amount
- The network
If anything looks wrong, you simply don’t approve it. This is not just a feature. It’s the only real solution against address-swapping attacks.
Be Extra Careful with DApps
Even if your wallet is secure, the DApp you connect to might not be. If it’s running compromised code, risks remain.
Our advice:
- Be cautious with DApps for now.
- Use ELLIPAL’s built-in swap and staking for essential transactions.
Cold Wallets Are More Important Than Ever
Hot wallets (browser extensions or mobile apps) can’t protect you here. If an address is swapped, you won’t notice, you’ll just approve blindly.
With a cold wallet like ELLIPAL, you stay in control. The final check happens on your secure device, not in compromised software.
Final Thought
This NPM attack proves one thing: crypto security isn’t just about passwords or antivirus.
It’s about keeping your keys completely offline and verifying every transaction yourself.
Clear Signing isn’t optional. It’s the inevitable choice for real security.
And that’s exactly what we built ELLIPAL to deliver.