September 10, 2025
Insights

NPM Supply Chain Incident: When the Transaction Layer Becomes the Last Defense

Open systems cannot be locked down, but they can be secured by verifying intent and stopping malicious flows before they hit the chain.

Hypernative

First bridges, then custody infrastructure, and now developer libraries. The trend is clear: attacks move down the stack until they hit bedrock. The only true backstop is defense at the transaction layer, where intent is verified and malicious flows are stopped before they hit the chain.

The latest example came this week, when a commonly used piece of code relied on by countless web applications was compromised. Any app that pulled it in became vulnerable. For users, the danger is simple: if a dApp uses the tainted code to create transactions, attackers can secretly change the details, showing you one thing on screen while redirecting funds elsewhere. Every affected app now has to patch, and users should confirm whether the services they rely on have already done so.

This is the risk of shared dependencies. When a single component is used by thousands of applications, a compromise in that component quickly spreads everywhere. In an environment where any link in the chain can be exploited, the only reliable safeguard is at the transaction itself, where intent can be verified and malicious flows can be stopped before they reach the chain.

What is really under attack here is trust in Web3 at the very moment when institutions are deciding whether to enter. If the foundations cannot be relied on, adoption slows before it even begins.

Gal Sagie,
Co-founder & CEO @ Hypernative

Defense at the Transaction Layer

Supply-chain compromises like this one expose dApps to Bybit-scale risks. Even something as routine as a token swap could be silently altered to route funds to an attacker’s wallet. When attackers reach the foundations of the stack, protection has to be built into the final step: the transaction. 

Hypernative Guardian and Wallet Protect deliver that protection with these capabilities:

  • Stop malicious addresses at the source. Our threat engine flags attacker wallets and contracts in real time. Any attempt to interact with those addresses is automatically denied before signing.
  • Detect novel attack vectors. Our simulation engine searches for a wide variety of attack vectors to tackle any new possibility of compromise.
  • Block anomalous transfers and approvals. Guardian policies treat deviations from normal behavior, such as sending assets to a new recipient or withdrawing to an unexpected address, as high-risk. These transactions are blocked until reviewed.
  • Empower security and risk teams. Guardian runs every transaction through a simulation, with custom checks for specific operations like swap destinations, staking withdrawals, or lending protocols. Security teams get the visibility to approve or deny with confidence, instead of relying on blind signing.

Read more: Inside M1 Capital’s Strategy to Guard Against DeFi Threats, Operationalize Custom Risk Detection, and Automate Transaction Approvals

In our Sept. 25 webinar, Hypernative CTO Dan Caspi and VP Strategy Marshall Lipman will explore how these threats play out in practice and how both wallets and institutions can stop them at the transaction layer. Save your seat by registering here.

The Hypernative Advantage

Hypernative combines battle-tested machine learning models, heuristics, simulations, and graph-based detections to identify threats with high accuracy, giving customers the ability to stop exploits before they happen. The platform monitors security, technical, financial, governance, and other risks across 70+ chains, detecting 99.5% of hacks last year with less than 0.001% false positives and preventing over $2B in losses to date.

Hypernative Guardian blocks malicious transactions before they are executed. It uses simulations, granular enforcement policies, and real-time AI threat prevention models to stop attacks as they happen. Guardian secures everything from routine transfers to multi-million-dollar, multi-step transactions, reducing blind signing and cutting manual reviews by 90 percent on average. By embedding protection directly into the transaction flow, it enables security, compliance, and risk teams to safeguard operations without slowing them down.


Wallet Protect brings enterprise-level protection to consumer wallets. It adds a pre-transaction security layer that blocks scams, drainers, and poisoned addresses by simulating intent, enforcing policies and providing human readable interpretation, reducing blind approvals and keeping users safe.

Reach out for a demo of Hypernative’s solutions, tune into Hypernative’s blog and our social channels to keep up with the latest on cybersecurity in Web3.

Secure everything you build, run and own in Web3 with Hypernative.

Website | X (Twitter) | LinkedIn

Secure everything you build, run, and, own onchain

Book a demo