{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T19:58:23.236Z",
  "tag": {
    "id": "chalk",
    "label": "Chalk",
    "isStack": false,
    "url": "https://pwn.watch/t/chalk",
    "feed": "https://pwn.watch/t/chalk/feed.xml"
  },
  "counts": {
    "incidents": 1,
    "live": 0,
    "notFullyPatched": 0,
    "patched": 1
  },
  "incidents": [
    {
      "slug": "chalk-debug-npm-hijack-september-2025",
      "title": "chalk, debug and 16 other npm packages (2B+ weekly downloads) hijacked via fake 2FA email",
      "url": "https://pwn.watch/i/chalk-debug-npm-hijack-september-2025",
      "json": "https://pwn.watch/i/chalk-debug-npm-hijack-september-2025.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "npm: chalk, debug, ansi-styles, strip-ansi, supports-color and 13 more",
      "tags": [
        "npm",
        "node",
        "chalk",
        "phishing",
        "supply-chain",
        "crypto"
      ],
      "cveIds": [],
      "affectedVersions": [
        "chalk 5.6.1",
        "debug 4.4.2",
        "ansi-styles 6.2.2",
        "strip-ansi 7.1.1",
        "supports-color 10.2.1",
        "ansi-regex 6.2.1",
        "wrap-ansi 9.0.1",
        "slice-ansi 7.1.1",
        "has-ansi 6.0.1",
        "chalk-template 1.1.1",
        "supports-hyperlinks 4.1.1",
        "others: see debug-js/debug#1005"
      ],
      "fixedVersions": [
        "chalk 5.6.2",
        "ansi-styles 6.2.3",
        "strip-ansi 7.1.2",
        "supports-color 10.2.2",
        "ansi-regex 6.2.2",
        "wrap-ansi 9.0.2",
        "slice-ansi 7.1.2",
        "has-ansi 6.0.2",
        "chalk-template 1.1.2",
        "supports-hyperlinks 4.1.2",
        "debug and others: republished by the maintainer on 2025-09-13"
      ],
      "startedAt": "2025-09-08",
      "closedAt": "2025-09-13",
      "updatedAt": "2025-09-15",
      "summary": "Maintainer Josh Junon (qix) was phished by a fake npm 2FA-reset email from npmjs.help. The attacker published malicious versions of 18 packages, including chalk, debug, ansi-styles and strip-ansi, with code that hijacked crypto wallet transactions in browsers. They were live for about two hours.",
      "xPost": null
    }
  ],
  "posts": [],
  "changes": [
    {
      "incident": "chalk-debug-npm-hijack-september-2025",
      "incidentTitle": "chalk, debug and 16 other npm packages (2B+ weekly downloads) hijacked via fake 2FA email",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-09-15",
      "title": "Initial CVEs posted",
      "body": null,
      "sourceUrl": "https://github.com/debug-js/debug/issues/1005",
      "url": "https://pwn.watch/i/chalk-debug-npm-hijack-september-2025"
    },
    {
      "incident": "chalk-debug-npm-hijack-september-2025",
      "incidentTitle": "chalk, debug and 16 other npm packages (2B+ weekly downloads) hijacked via fake 2FA email",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-09-13",
      "title": "All remaining affected packages republished by the maintainer",
      "body": null,
      "sourceUrl": "https://github.com/debug-js/debug/issues/1005",
      "url": "https://pwn.watch/i/chalk-debug-npm-hijack-september-2025"
    },
    {
      "incident": "chalk-debug-npm-hijack-september-2025",
      "incidentTitle": "chalk, debug and 16 other npm packages (2B+ weekly downloads) hijacked via fake 2FA email",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-09-08",
      "title": "Malicious versions start appearing on npm (13:16 UTC)",
      "body": null,
      "sourceUrl": "https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised",
      "url": "https://pwn.watch/i/chalk-debug-npm-hijack-september-2025"
    },
    {
      "incident": "chalk-debug-npm-hijack-september-2025",
      "incidentTitle": "chalk, debug and 16 other npm packages (2B+ weekly downloads) hijacked via fake 2FA email",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-09-08",
      "title": "Sindre Sorhus publishes clean chalk-family versions over the compromised ones",
      "body": null,
      "sourceUrl": "https://github.com/chalk/chalk/issues/656",
      "url": "https://pwn.watch/i/chalk-debug-npm-hijack-september-2025"
    },
    {
      "incident": "chalk-debug-npm-hijack-september-2025",
      "incidentTitle": "chalk, debug and 16 other npm packages (2B+ weekly downloads) hijacked via fake 2FA email",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-09-08",
      "title": "npm takes down all impacted versions (21:59 CEST); maintainer account restored (23:48 CEST)",
      "body": null,
      "sourceUrl": "https://github.com/debug-js/debug/issues/1005",
      "url": "https://pwn.watch/i/chalk-debug-npm-hijack-september-2025"
    }
  ]
}