"Yep, I got pwned. Sorry everyone, very embarrassing."

An open-source maintainer account (qix) was social-engineered and used to push malware into popular NPM packages (e.g., chalk, debug, ansi-styles). The payload aimed to intercept browser network calls and wallet transactions (including MetaMask) to replace legitimate crypto addresses with attacker wallets across multiple blockchains; CI errors limited the live window to roughly two hours. The incident highlights severe supply-chain risk in open-source ecosystems and recommends stronger CI/CD safeguards, phishing-resistant MFA, trusted publishing, and monitoring of package changes.