A large-scale supply chain attack on the JavaScript ecosystem has prompted an urgent warning from Ledger's chief technology officer, Charles Guillemet, who advised users without hardware wallets to ...

The notification arrived on September 14, 2025, at 17:58 UTC. Somewhere in the sprawling npm registry—home to 2.5 million JavaScript packages that power everything from banking apps to smart ...