Posted
The open-source JavaScript ecosystem has just experienced one of its most significant security breaches to date. A sophisticated supply chain attack compromised over 20 popular npm packages—impacting billions of weekly downloads. Among the affected libraries was Prebid.js, a critical component in the programmatic advertising stack.
As an ad quality and security vendor, we believe this incident demands urgent attention from publishers, SSPs, DSPs, and anyone relying on Prebid.js for header bidding.
UPDATE View the latest on github at https://github.com/advisories/GHSA-m662-56rj-8fmm
The attack began with a phishing campaign targeting npm maintainers. One victim, known as “Qix,” had their credentials stolen, allowing attackers to publish malicious versions of widely used packages like chalk
, debug
, and ansi-styles
. These packages are deeply embedded in frontend build tools and web applications.
The malware was designed to execute in browsers, hooking into APIs such as window.fetch
, XMLHttpRequest
, and window.ethereum.request
. Its goal? To silently intercept and redirect cryptocurrency transactions from users with connected wallets.
In a second wave, additional NPM accounts were compromised, and malicious versions of prebid@10.9.1
, prebid@10.9.2
, and prebid-universal-creative@1.17.3
were published before being reported and removed.
Prebid.js is the backbone of header bidding implementations across thousands of publisher websites. Its compromise—even briefly—raises serious concerns:
As a security-focused vendor, we recommend the following immediate actions:
Check your build pipelines for any use of prebid@10.9.1
, prebid@10.9.2
, and prebid-universal-creative@1.17.3
. Remove and replace them with verified safe versions.
Avoid automatic updates in production. Use lockfiles and npm ci
to ensure consistent, secure builds.
Implement runtime monitoring to detect suspicious API hooks or network activity.
Ensure developers and maintainers are trained to recognize phishing attempts and follow secure publishing practices.
The inclusion of Prebid.js in this attack is a stark reminder of how vulnerable the ad tech ecosystem is to supply chain threats. Open-source software is powerful—but it’s only as secure as the processes that govern it.
We’re committed to helping our partners secure their ad infrastructure and will continue to monitor this evolving threat landscape.
Stay safe. Stay vigilant.
Sources:
The Hacker News – 20 Popular npm Packages Compromised - Socket.dev – DuckDB npm Account Compromised - Vercel – Critical npm Supply Chain Attack Response
The Big Shifts Shaping the Future of Ad Tech: 3 Key Takeaways from the 2025 NAI Summit
Go to Post
Text LinkAI Adoption, Evolving Enforcement & the Convergence of Privacy & Security: 6 Big Takeaways from the 2025 PSF Spring Academy
Go to Post
Text LinkInside the California Law Association Privacy Summit: What Regulators Are Really Watching
Go to Post
Text LinkBoltive Launches New Product Ad Monitor: Revolutionizing Ad Insights with AI-Powered Discovery Engine
Go to Post
Text LinkIAPP GPS - Our Thoughts, Part 2: What Regulators Want Us To Do – The Value of Proactivity
Go to Post
Text LinkIAPP GPS - Our Thoughts, Part 1: What Regulators Want Us To Know – Busting Common Myths
Go to Post
Text LinkPrioritizing Children's Privacy: Strategies for Ethical Advertising and the Use of AI
Go to Post
Text LinkBusiness Ninjas Podcast - Secure Protection for Advertisers Against Invasive Media
Go to Post
Text LinkAutomating Threat Detection: How Boltive is Harnessing Artificial Intelligence to Reshape Ad Security
Go to Post
Text LinkForbes Article - The Privacy Prescription: Rules Restricting Health Data Use And How To Employ More Holistic Security Measures
Go to Post
Text LinkOur CEO, Dan Frechtling, featured on Leadership Live podcast with Daphna Horowitz
Go to Post
Text LinkWhy Data Privacy is Being Overhauled in 2023: Dan Frechtling featured on the Security Weekly Productions podcast
Go to Post
Text LinkOur Director of Product, Christine Desrosiers, discusses the current state of Ad Tech with Brand Safety Institute
Go to Post
Text LinkGeekwire wrote about the heartening link that brought our CEO and CFO to Boltive.
Go to Post
Text Link