TLDR
The breached ethereum-name-service/">ENS?linked npm packages included content-hash, address-encoder, ensjs, ens-validation, ethereum-ens, and ens-contracts, plus dozens more under the @ensdomains scope reported in the press.
- Over 40 packages under @ensdomains were affected in the Shai Hulud supply chain incident noted by media.
- ENS said its websites and user names were unaffected, and advised developers to update and rotate keys if they installed during the window in an announcement.
- The wider campaign compromised 400+ libraries and 25,000+ repos across the ecosystem per coverage.
Deep Dive
1. Core ENS Packages
Key ENS?related libraries implicated were content-hash, address-encoder, ensjs, ens-validation, ethereum-ens, and ens-contracts. These are widely used in wallet interfaces and ENS integrations, which is why their compromise drew attention according to analysis.
Media reports add that the breach extended to more than 40 libraries within the @ensdomains namespace, indicating a broad scope across the ENS package family as covered.
If your project depended on @ensdomains packages, assume exposure during the affected versions and upgrade to the latest fixed releases.
2. Scope and Timeline
This was part of a larger npm supply chain incident dubbed Shai Hulud that hit hundreds of packages and tens of thousands of repositories, with malware aimed at harvesting developer credentials, API keys, and tokens reported by media.
ENS stated the affected packages were those starting with @ensdomains published around 5:49 am UTC on 24 Nov, and that it updated latest tags, rotated keys, and attempted to unpublish impacted versions in an announcement.
The risk centered on developer environments and build pipelines rather than ENS name ownership or ENS?hosted sites.
3. Impact and Safety
ENS Labs said its websites and name records showed no signs of impact, and user assets or names were not affected. The guidance focused on developers who installed ENS packages within the window to reinstall safe versions and rotate credentials per the announcement above.
The broader campaign compromised 400+ libraries and hit high?download packages across crypto and non?crypto ecosystems, magnifying downstream risk via dependency chains as covered.
If you built or deployed with affected ENS libraries during the window, treat secrets as compromised, re?install patched versions, and review CI credentials. Low depth plus transitive dependencies can amplify blast radius.
Conclusion
In short, high?use ENS libraries like content-hash, address-encoder, ensjs, ens-validation, ethereum-ens, and ens-contracts, along with 40+ @ensdomains packages, were swept into a wider npm supply chain incident. The issue targeted developer credentials, not ENS names or sites, but any project that installed affected versions should upgrade and rotate secrets to contain downstream risk.
CoinsKid.Com