Digest · Monday

Security digest: September 8, 2025

1 editorial brief and 3 critical advisories.

All digests · RSS · Markdown

Take stock

Most can relax: qix npm account hijack (chalk/debug). Teams that built and shipped a browser bundle (especially a web3 or wallet-connected front end) with dependencies resolved on Sep 8, 2025, during the window, and anyone whose lockfile still pins a listed version.
npm: 2 critical advisories (@akoskm/create-mcp-server-stdio, codeceptjs). Check with npm audit (or: npm ls <package>).
Go: 1 critical advisory (github.com/prest/prest/v2). Check with govulncheck ./....
None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Most can relax

Sep 8, 2025 · Malicious package

chalk, debug and 16+ npm Packages Hijacked via Phishing

Despite billions of weekly downloads, the bad versions were live for about two hours and the payload only swapped crypto addresses inside browsers, so most teams just need to confirm no lockfile or bundle captured them.

Must act: Teams that built and shipped a browser bundle (especially a web3 or wallet-connected front end) with dependencies resolved on Sep 8, 2025, during the window, and anyone whose lockfile still pins a listed version.

Can relax: Server-side and CLI users, and anyone whose lockfiles show none of the listed versions; the payload targeted browser wallet traffic, not Node secrets.

Search lockfiles for the listed versions: grep -nE '"(chalk|debug|ansi-styles|strip-ansi|supports-color|ansi-regex|wrap-ansi)"' -A2 package-lock.json, or npm ls chalk debug.
If any listed version appears, delete node_modules, run npm cache clean --force, reinstall from a corrected lockfile, and rebuild and redeploy front-end bundles built on Sep 8, 2025.
Purge the versions from internal registry proxies and CI caches.

Read the brief →