Chalk
Security incidents tagged Chalk. Newest first.
0 Chalk incidents in the last 12 months
Critical 4 · High 3 · Med 2 · Low 1 · Update ½Severity-weighted: critical 4 · high 3 · medium 2 · low 1 · update ½LessMore
- Incidents
- 1
- Live
- 0
- Patched
- 1
- Days without an incident
- 404
- Longest quiet run: 402 days (Sep 16–Oct 22)
Show 1 older incident1 older incident
September 2025 1
- CriticalPatched
chalk, debug and 16 other npm packages (2B+ weekly downloads) hijacked via fake 2FA email
Maintainer Josh Junon (qix) was phished by a fake npm 2FA-reset email from npmjs.help. The attacker published malicious versions of 18 packages, including chalk, debug, ansi-styles and strip-ansi, with code that hijacked crypto wallet transactions in browsers. They were live for about two hours.
npm: chalk, debug, ansi-styles, strip-ansi, supports-color and 13 moreClosed Sep 13, 2025
