TLDR
Several ethereum-name-service/">Ethereum Name Service (ENS) related JavaScript packages on npm were compromised in a recent supply chain attack. Reported affected names include content-hash, address-encoder, ensjs, ens-validation, ethereum-ens, and ens-contracts per a market report.
- A non-ENS but widely used wallet helper, crypto-addr-codec, was also flagged as compromised in coverage.
- The incident is tied to a large Shai Hulud npm malware campaign impacting hundreds of packages and tens of thousands of repos per an analysis.
Deep Dive
1. Affected Packages
Reports list the compromised ENS-linked libraries as content-hash, address-encoder, ensjs, ens-validation, ethereum-ens, and ens-contracts, with high weekly download counts across the ecosystem per a market report. A separate crypto library, crypto-addr-codec, was also identified as compromised during the same wave in coverage.
If your apps depend on these packages or dependents, you should assume potential exposure until you verify versions and provenance.
2. Scope And Impact
Security researchers describe a broad npm supply chain breach, dubbed Shai Hulud, infiltrating 400 to 490 packages and more than 25,000 repositories, with credential-stealing behavior and automated propagation through dependency chains per an analysis. Multiple crypto-focused libraries are involved, and some impacted packages routinely see tens of thousands of weekly downloads per a market report.
Even indirect users may be affected via transitive dependencies. The risk centers on stolen secrets, not only direct code execution in crypto apps.
3. Mitigation Status
Coverage citing ENS Labs states the breach window spanned Nov 2123 and that ENS updated affected package versions and rotated credentials, with no indication of impact to ENS-operated sites or user assets at that time per a security update summary. The broader Shai Hulud incident remains under investigation across the JavaScript ecosystem per an analysis.
Developers should validate dependency trees, pin safe versions, and rotate any credentials that might have been accessible during the affected window.
Conclusion
The compromised ENS-related packages named in public reports are content-hash, address-encoder, ensjs, ens-validation, ethereum-ens, and ens-contracts, with crypto-addr-codec also flagged. The event is part of a larger npm supply chain attack focused on credential theft and dependency propagation. The practical takeaway is to verify dependency versions and rotate secrets where exposure is plausible.
CoinsKid.Com