https://pwn.watch/t/chalk Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Mon, 15 Sep 2025 00:00:00 GMT https://pwn.watch/i/chalk-debug-npm-hijack-september-2025 https://pwn.watch/i/chalk-debug-npm-hijack-september-2025 Mon, 15 Sep 2025 00:00:00 GMT critical <p>Maintainer Josh Junon (qix) was phished by a fake npm 2FA-reset email from npmjs.help. The attacker published malicious versions of 18 packages, including chalk, debug, ansi-styles and strip-ansi, with code that hijacked crypto wallet transactions in browsers. They were live for about two hours.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> chalk 5.6.2, ansi-styles 6.2.3, strip-ansi 7.1.2, supports-color 10.2.2, ansi-regex 6.2.2, wrap-ansi 9.0.2, slice-ansi 7.1.2, has-ansi 6.0.2, chalk-template 1.1.2, supports-hyperlinks 4.1.2, debug and others: republished by the maintainer on 2025-09-13</p> <p><strong>Latest updates:</strong></p><ul><li>2025-09-15: Initial CVEs posted (<a href="https://github.com/debug-js/debug/issues/1005">source</a>)</li><li>2025-09-13: All remaining affected packages republished by the maintainer (<a href="https://github.com/debug-js/debug/issues/1005">source</a>)</li><li>2025-09-08: Malicious versions start appearing on npm (13:16 UTC) (<a href="https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised">source</a>)</li></ul>