The attacker behind the NPM developer account is suspected to have only made about $20.

According to CertiK Alert, developer Qix's NPM account was targeted by a phishing attack, with the attacker injecting malicious code into NPM. According to the Security Alliance, the attacker appears to have profited only approximately $0.05 in ETH and $20 in Meme coins. Previously, Ledger CTO Charles Guillemet stated, "A large-scale supply chain attack is currently underway: a well-known developer's NPM account has been compromised. Affected packages have been downloaded over 1 billion times, potentially putting the entire JavaScript ecosystem at risk. The malicious code works by silently tampering with cryptocurrency addresses in the background to steal funds."