Uploaded September 2025 | Updated September 2026, 2 weeks ago

---

The biggest hack ever, but was it consequential?

The other day there was a successful spear phishing attack on a developer who was a maintainer for many extremely popular packages on the NPM package manager. The packages total over 2.5 Billion weekly downloads, and they were all injected with malware. Even though the malicious versions were only up for a few hours, it's likely they were downloaded 10s of millions of times. In this video I explain what the malware did and how the the developer got phished, and more.

▼ Time Stamps: ▼
0:00 - Intro
0:23 - What is NPM?
0:54 - What Happened?
2:48 - What Did The Malware Do?
5:06 - Did The Attack Work?
6:34 - How Did He Get Phished?
7:41 - Do You Need To Do Anything?

▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬
• My Gear & Equipment ⇨ kit.co/ThioJoe
• Merch ⇨ teespring.com/stores/thiojoe
• My Desktop Wallpapers ⇨ https://thiojoe.art/
⇨ Instagram.com/ThioJoe
⇨ Twitter.com/ThioJoe
⇨ Facebook.com/ThioJoeTV
▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬