Sep 8, 2025
1 new incident, 0 with updates.
Started
- ClosedPatched
chalk, debug and 16 other npm packages (2B+ weekly downloads) hijacked via fake 2FA email
Maintainer Josh Junon (qix) was phished by a fake npm 2FA-reset email from npmjs.help. The attacker published malicious versions of 18 packages, including chalk, debug, ansi-styles and strip-ansi, with code that hijacked crypto wallet transactions in browsers. They were live for about two hours.
npm: chalk, debug, ansi-styles, strip-ansi, supports-color and 13 moreClosed Sep 13, 2025
