On September 8, 2025, 18 widely used npm packages were compromised via an account takeover of maintainer ‘qix’. Affected packages collectively receive 2.6+ billion downloads per week. Malicious versions were live for approximately 2 hours before detection and removal. The malicious payload targeted browser-based crypto wallets by hooking web3 APIs to reroute transactions. CISA issued an advisory on September 23, 2025. The malicious code reached 1 in 10 cloud environments during the 2-hour window. A follow-on campaign ‘Shai-Hulud 2.0’ was identified in November 2025. Exemplary case of npm ecosystem account takeover via phishing and adversary-in-the-middle credential capture defeating TOTP-based MFA.