{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "chalk, debug and 16 other npm packages (2B+ weekly downloads) hijacked via fake 2FA email · updates",
  "home_page_url": "https://pwn.watch/i/chalk-debug-npm-hijack-september-2025",
  "feed_url": "https://pwn.watch/i/chalk-debug-npm-hijack-september-2025/feed.json",
  "description": "Maintainer Josh Junon (qix) was phished by a fake npm 2FA-reset email from npmjs.help. The attacker published malicious versions of 18 packages, including chalk, debug, ansi-styles and strip-ansi, with code that hijacked crypto wallet transactions in browsers. They were live for about two hours.",
  "language": "en",
  "_pwn": {
    "slug": "chalk-debug-npm-hijack-september-2025",
    "severity": "critical",
    "status": "closed",
    "patchStatus": "patched",
    "rss": "https://pwn.watch/i/chalk-debug-npm-hijack-september-2025/feed.xml",
    "llms": "https://pwn.watch/i/chalk-debug-npm-hijack-september-2025/llms.txt",
    "json": "https://pwn.watch/i/chalk-debug-npm-hijack-september-2025.json"
  },
  "items": [
    {
      "id": "https://pwn.watch/i/chalk-debug-npm-hijack-september-2025#2025-09-15-4567334d",
      "url": "https://pwn.watch/i/chalk-debug-npm-hijack-september-2025#2025-09-15-4567334d",
      "title": "chalk, debug and 16 other npm packages (2B+ weekly downloads) hijacked via fake 2FA email: Initial CVEs posted",
      "content_text": "chalk, debug and 16 other npm packages (2B+ weekly downloads) hijacked via fake 2FA email: Initial CVEs posted\n\nSource: https://github.com/debug-js/debug/issues/1005",
      "date_published": "2025-09-15T00:00:00.000Z",
      "external_url": "https://github.com/debug-js/debug/issues/1005",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/chalk-debug-npm-hijack-september-2025#2025-09-13-d576222c",
      "url": "https://pwn.watch/i/chalk-debug-npm-hijack-september-2025#2025-09-13-d576222c",
      "title": "chalk, debug and 16 other npm packages (2B+ weekly downloads) hijacked via fake 2FA email: All remaining affected packages republished by the maintainer",
      "content_text": "chalk, debug and 16 other npm packages (2B+ weekly downloads) hijacked via fake 2FA email: All remaining affected packages republished by the maintainer\n\nSource: https://github.com/debug-js/debug/issues/1005",
      "date_published": "2025-09-13T00:00:00.000Z",
      "external_url": "https://github.com/debug-js/debug/issues/1005",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/chalk-debug-npm-hijack-september-2025#2025-09-08-d4472329",
      "url": "https://pwn.watch/i/chalk-debug-npm-hijack-september-2025#2025-09-08-d4472329",
      "title": "chalk, debug and 16 other npm packages (2B+ weekly downloads) hijacked via fake 2FA email: Malicious versions start appearing on npm (13:16 UTC)",
      "content_text": "chalk, debug and 16 other npm packages (2B+ weekly downloads) hijacked via fake 2FA email: Malicious versions start appearing on npm (13:16 UTC)\n\nSource: https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised",
      "date_published": "2025-09-08T00:00:00.000Z",
      "external_url": "https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/chalk-debug-npm-hijack-september-2025#2025-09-08-ae3aa0e3",
      "url": "https://pwn.watch/i/chalk-debug-npm-hijack-september-2025#2025-09-08-ae3aa0e3",
      "title": "chalk, debug and 16 other npm packages (2B+ weekly downloads) hijacked via fake 2FA email: Sindre Sorhus publishes clean chalk-family versions over the compromised ones",
      "content_text": "chalk, debug and 16 other npm packages (2B+ weekly downloads) hijacked via fake 2FA email: Sindre Sorhus publishes clean chalk-family versions over the compromised ones\n\nSource: https://github.com/chalk/chalk/issues/656",
      "date_published": "2025-09-08T00:00:00.000Z",
      "external_url": "https://github.com/chalk/chalk/issues/656",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/chalk-debug-npm-hijack-september-2025#2025-09-08-1cac92ff",
      "url": "https://pwn.watch/i/chalk-debug-npm-hijack-september-2025#2025-09-08-1cac92ff",
      "title": "chalk, debug and 16 other npm packages (2B+ weekly downloads) hijacked via fake 2FA email: npm takes down all impacted versions (21:59 CEST); maintainer account restored (23:48 CEST)",
      "content_text": "chalk, debug and 16 other npm packages (2B+ weekly downloads) hijacked via fake 2FA email: npm takes down all impacted versions (21:59 CEST); maintainer account restored (23:48 CEST)\n\nSource: https://github.com/debug-js/debug/issues/1005",
      "date_published": "2025-09-08T00:00:00.000Z",
      "external_url": "https://github.com/debug-js/debug/issues/1005",
      "tags": [
        "critical"
      ]
    }
  ]
}