Microsoft warns of new npm Trojan targeting crypto wallets

Microsoft has issued an urgent warning about two malicious npm packages, huggingface-hub and transformers , which distribute a RAT (Remote Access Trojan) capable of stealing crypto wallet credentials, capturing screenshots, and logging keystrokes. These packages, used to interact with AI models hosted on the Hugging Face platform, specifically target development environments where crypto wallet management tools or financial automation scripts are deployed. No victims have been officially identified yet, but the method suggests a targeted campaign against players in the crypto sector. The facts The two malicious npm packages, huggingface-hub and transformers , were detected distributing a RAT capable of stealing crypto wallet private keys and logging keystrokes. According to Microsoft, these packages were downloaded more than 10,000 times before they were detected and removed. The RAT is also able to capture screenshots and exfiltrate sensitive data via encrypted channels. No direct evidence of fund theft has been reported to date. Hugging Face confirmed the removal of the malicious packages and warned developers against using unverified versions. The self-custodial wallet Ambire Wallet, with a market capitalization of 8.67 million USD, could be exposed if users installed the infected packages. Why it matters This attack highlights the risks linked to software dependencies in the JavaScript ecosystem, where legitimate npm packages can be compromised to infiltrate development environments. Once installed, the RAT can run in the background, making detection difficult without dedicated security tools. The disclosure of this flaw could erode user trust in self-custodial wallets and crypto-related development tools, particularly those relying on npm dependencies. In the short term, assets such as INJ (Injective Protocol) or REAL (RealFi), which depend on secure infrastructure for their adoption, could face selling pressure. Conversely, DeFi platforms and security-focused protocols could benefit from an influx of liquidity if users turn to safer solutions. Such a flaw could also strengthen regulators' arguments in favor of stricter cybersecurity standards for crypto wallets, particularly in the context of discussions on laws such as the CLARITY Act in the United States. To watch Security audits: projects such as Ambire Wallet or Injective could publish additional audits or software updates to reassure users. Regulatory reaction: such a flaw could accelerate discussions on cybersecurity standards for crypto wallets, particularly within the framework of the CLARITY Act. The actual scale of the attack: no victims have been officially identified yet, and Microsoft has not specified whether any funds were stolen. Dependence on detection tools: detecting a RAT in an npm environment requires specialized tools, making the threat difficult for users to identify without these solutions. Platform response: although Hugging Face reacted quickly by removing the malicious packages, developer trust could take time to recover.