The credential stealer harvested username, password, and 2FA codes before sending them to a remote host. With full access, the attacker republished every "qix" package with a crypto-focused payload.
Corporate trading desks increased exposure as volume surged 85% to $333.21 million, though regulatory uncertainties persist around stablecoin framework implementation.
Rate-cut optimism and gold’s rally have not spilled into crypto, where positioning stays defensive and near-term direction hinges on the inflation report.
According to Guillemet, the malicious code — already pushed into packages with over 1 billion downloads — is designed to silently swap crypto wallet addresses in transactions. That means unsuspecting users could send funds directly to the attacker without realizing it.