Major npm Library Compromise and New HTTP Security Feature Discussed in Stormcast Podcast

In the September 9, 2025 edition of the Sans Internet Storm Centers Stormcast podcast, Johannes Ullrich, recording from Jacksonville, Florida, addresses a critical issue: a major compromise of the npm library. Unlike his usual format, Johannes begins with this important news before moving on to the daily journal.

The compromise involves an npm developer known as QIX or quicks, whose several major libraries were affected. Among the compromised libraries are "error-ex" with 47 million downloads per week and "color name" with 199 million downloads per week. These libraries were modified to include browser hijacking functions. The hijacked libraries intercept calls to XMLHttpRequest and fetch, looking for requests to cryptocurrency-related domains. They replace these requests with similar domains to intercept cryptocurrency keys, usernames, and passwords.

The cause of this compromise is a phishing attack. The attackers used a fraudulent domain, npmjs.help, to send phishing emails without triggering spam filters. This recently registered domain allowed the attackers to steal the passwords of several npm developers, including that of quicks, who had access to many popular libraries.

To defend against such attacks, Johannes recommends using detection tools like iikido.deaf, which identified this attack. He also emphasizes the importance of locking library versions and deliberately updating after verifying new versions. He mentions that several tools, including Snick and Soner type, also detected and blocked this attack.

Next, Johannes discusses a new HTTP security feature: HTTP request signature headers. This feature, standardized in February of the previous year, allows clients to digitally sign all or part of a request. For example, the "host" header can be signed to verify the authenticity of the request. This method is particularly useful for search engines and bots crawling the web, as it allows verifying the origin of requests without relying solely on IP addresses or User-Agent headers, which can be forged.

Johannes concludes by highlighting the importance of this new feature for securing web interactions, especially with the increase in AI agents crawling the web. He mentions that companies like OpenAI are starting to use this feature, although he has not yet seen major companies adopt it widely.

In summary, this edition of the podcast sheds light on a major compromise of the npm library and introduces a new HTTP security feature. This information is crucial for understanding current threats and ways to secure web interactions.