chalk, debug and 16 other npm packages (2B+ weekly downloads) hijacked via fake 2FA email ยท updates https://pwn.watch/i/chalk-debug-npm-hijack-september-2025 Maintainer Josh Junon (qix) was phished by a fake npm 2FA-reset email from npmjs.help. The attacker published malicious versions of 18 packages, including chalk, debug, ansi-styles and strip-ansi, with code that hijacked crypto wallet transactions in browsers. They were live for about two hours. en Mon, 15 Sep 2025 00:00:00 GMT chalk, debug and 16 other npm packages (2B+ weekly downloads) hijacked via fake 2FA email: Initial CVEs posted https://pwn.watch/i/chalk-debug-npm-hijack-september-2025 https://pwn.watch/i/chalk-debug-npm-hijack-september-2025#2025-09-15-4567334d Mon, 15 Sep 2025 00:00:00 GMT critical <p><a href="https://github.com/debug-js/debug/issues/1005">Source</a></p> chalk, debug and 16 other npm packages (2B+ weekly downloads) hijacked via fake 2FA email: All remaining affected packages republished by the maintainer https://pwn.watch/i/chalk-debug-npm-hijack-september-2025 https://pwn.watch/i/chalk-debug-npm-hijack-september-2025#2025-09-13-d576222c Sat, 13 Sep 2025 00:00:00 GMT critical <p><a href="https://github.com/debug-js/debug/issues/1005">Source</a></p> chalk, debug and 16 other npm packages (2B+ weekly downloads) hijacked via fake 2FA email: Malicious versions start appearing on npm (13:16 UTC) https://pwn.watch/i/chalk-debug-npm-hijack-september-2025 https://pwn.watch/i/chalk-debug-npm-hijack-september-2025#2025-09-08-d4472329 Mon, 08 Sep 2025 00:00:00 GMT critical <p><a href="https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised">Source</a></p> chalk, debug and 16 other npm packages (2B+ weekly downloads) hijacked via fake 2FA email: Sindre Sorhus publishes clean chalk-family versions over the compromised ones https://pwn.watch/i/chalk-debug-npm-hijack-september-2025 https://pwn.watch/i/chalk-debug-npm-hijack-september-2025#2025-09-08-ae3aa0e3 Mon, 08 Sep 2025 00:00:00 GMT critical <p><a href="https://github.com/chalk/chalk/issues/656">Source</a></p> chalk, debug and 16 other npm packages (2B+ weekly downloads) hijacked via fake 2FA email: npm takes down all impacted versions (21:59 CEST); maintainer account restored (23:48 CEST) https://pwn.watch/i/chalk-debug-npm-hijack-september-2025 https://pwn.watch/i/chalk-debug-npm-hijack-september-2025#2025-09-08-1cac92ff Mon, 08 Sep 2025 00:00:00 GMT critical <p><a href="https://github.com/debug-js/debug/issues/1005">Source</a></p>