There are basically no discussions about NPM supply chain attacks in the Chinese community, let me briefly explain what happened and why the founder @DrPayFi suddenly said "HUMA is SAFU"
On September 8-9, 2025, the largest supply chain attack in NPM history occurred, where attackers used phishing methods to obtain the NPM accounts of well-known developers and implanted malicious code in core JavaScript packages, targeting the entire Web3, not just @Huma Finance 🟣
In simple terms, developers generally do not reinvent the wheel, so if there are ready-made development tools (packages), they will use them directly. However, if these development tools are embedded with malicious code, it becomes very dangerous
Huma's frontend is built using React, and the development toolchain relies on NPM. The browser-side code directly interacts with the user wallet API. The actual loss from this attack was only about $500, but precautions must be taken
The boss confirmed immediately that Huma did not introduce the attacked packages, but advised to remember to check before signing, and it’s best to clear the cache or something similar to ensure it's the latest version
@Huma Finance 🟣 @Huma Finance 🟣
#HumaFinance
On September 8-9, 2025, the largest supply chain attack in NPM history occurred, where attackers used phishing methods to obtain the NPM accounts of well-known developers and implanted malicious code in core JavaScript packages, targeting the entire Web3, not just @Huma Finance 🟣
In simple terms, developers generally do not reinvent the wheel, so if there are ready-made development tools (packages), they will use them directly. However, if these development tools are embedded with malicious code, it becomes very dangerous
Huma's frontend is built using React, and the development toolchain relies on NPM. The browser-side code directly interacts with the user wallet API. The actual loss from this attack was only about $500, but precautions must be taken
The boss confirmed immediately that Huma did not introduce the attacked packages, but advised to remember to check before signing, and it’s best to clear the cache or something similar to ensure it's the latest version
@Huma Finance 🟣 @Huma Finance 🟣
#HumaFinance