A large-scale supply chain attack is compromising the JavaScript ecosystem, potentially impacting crypto users. Users of hardware wallets should carefully review transactions, while those without hardware wallets should avoid on-chain transactions for now. This highlights the ongoing security risks in the crypto space, suggesting that holding assets with secure third parties might be safer than self-custody for many.