chalk, debug and 16 other npm packages (2B+ weekly downloads) hijacked via fake 2FA email
npm: chalk, debug, ansi-styles, strip-ansi, supports-color and 13 more
Maintainer Josh Junon (qix) was phished by a fake npm 2FA-reset email from npmjs.help. The attacker published malicious versions of 18 packages, including chalk, debug, ansi-styles and strip-ansi, with code that hijacked crypto wallet transactions in browsers. They were live for about two hours.
Why this severity: Supply-chain compromise of packages with 2B+ weekly downloads (crypto-drainer payload)
- Started
- Sep 8, 2025
- Closed
- Sep 13, 2025
Affected
- chalk 5.6.1
- debug 4.4.2
- ansi-styles 6.2.2
- strip-ansi 7.1.1
- supports-color 10.2.1
- ansi-regex 6.2.1
- wrap-ansi 9.0.1
- slice-ansi 7.1.1
- has-ansi 6.0.1
- chalk-template 1.1.1
- supports-hyperlinks 4.1.1
- others: see debug-js/debug#1005
Fixed in
- chalk 5.6.2
- ansi-styles 6.2.3
- strip-ansi 7.1.2
- supports-color 10.2.2
- ansi-regex 6.2.2
- wrap-ansi 9.0.2
- slice-ansi 7.1.2
- has-ansi 6.0.2
- chalk-template 1.1.2
- supports-hyperlinks 4.1.2
- debug and others: republished by the maintainer on 2025-09-13
Timeline5
Initial CVEs posted
SourceAll remaining affected packages republished by the maintainer
SourceMalicious versions start appearing on npm (13:16 UTC)
SourceSindre Sorhus publishes clean chalk-family versions over the compromised ones
Sourcenpm takes down all impacted versions (21:59 CEST); maintainer account restored (23:48 CEST)
Source
News & write-ups5
- Version 5.6.1 published to npm is compromised (chalk#656)GitHub · Sep 8, 2025
- Version 4.4.2 published to npm is compromised (debug#1005)GitHub · Sep 8, 2025
- npm debug and chalk packages compromisedAikido · Sep 8, 2025 · Write-up
- Hackers hijack npm packages with 2 billion weekly downloads in supply chain attackBleepingComputer
- Fake npm 2FA reset email led to compromise of popular code packagesHelp Net Security · Sep 9, 2025
Get an email when a new major security incident drops. No spam, unsubscribe any time.
