npm supply chain worms can compromise Chrome extension builds and push malicious updates to millions of users
In December 2025, the Sha1-Hulud npm worm infected developer accounts and gained access to Trust Wallet's source code and Chrome Web Store API key. The attacker pushed a malicious extension update (v2.68) on Christmas Eve that harvested private keys from all logged-in users, draining $8.5 million from 2,520 wallets in 48 hours. Trust Wallet had 1 million users and Google's verification badge. This incident exposed that any extension relying on npm packages for its build pipeline is one compromised dependency away from a full supply chain takeover. A 2025 arxiv paper studying malicious browser extensions found the npm attack surface is systematically underdefended. The previous 2024 Cyberhaven phishing attack (400K users affected) showed a different but related path: phished developer credentials enabling the same malicious update push.
A browser extension that audits the npm build chain and gates Chrome Web Store publishes when malicious packages are detected
523 ▲Score Breakdown
Social Proof 2 sources
Existing Solutions 2 competitors
npm package security scanner that detects malicious dependencies and supply chain attacks before they ship.
Developer security platform that scans dependencies for vulnerabilities and malicious packages.
Gap Assessment
Socket.dev scans npm packages for malicious code but does not integrate with Chrome Web Store publishing pipelines. No tool specifically monitors the build-to-publish chain for Chrome extensions. Google's own verification badge did not protect Trust Wallet users. An extension-specific supply chain security product does not exist.