Two-File Supply Chain Attack Targets npm Package via Rogue Registry Redirect

A security researcher discovered a malicious pull request submitted to their open-source repository, sebs/etherscan-api, designed to redirect all npm package resolution to an attacker-controlled server. The PR was disguised as a routine refactor, adding a convincing description with bullet points and developer-friendly language to lower the maintainer's guard. The attack used just two file changes: a .npmrc file that silently overrode the default npm registry with a bare IP address on a non-standard port using unencrypted HTTP, and a package.json update adding a fake dependency to justify the .npmrc change. Because the rogue registry handled all package resolution, the attacker could serve trojaned versions of any dependency fetched during installation. The submitting account appeared legitimate, featuring an aged profile, repository history, and GitHub achievement badges, illustrating how modern supply chain attacks rely as much on social engineering as technical exploits.