Crypto malware attacks: 23 supply chain incidents set off alarms

ReversingLabs' 2025 Software Supply Chain Security Report documents 23 cryptocurrency-focused supply-chain attacks in 2024 targeting npm and PyPI, ranging from typosquatting campaigns (e.g., BIPClip) to more sophisticated compromises—such as a malicious update to a previously legitimate Python crypto client (aiocpa) and injected exfiltration code in popular @solana/web3.js releases—demonstrating growing attacker sophistication and financial motivation and underscoring the need for stronger OSS supply-chain security.