---
title: "Security digest: September 8, 2025"
url: https://erroneo.us/security/2025-09-08/
description: "September 8, 2025 vulnerability digest: 1 brief (qix npm account hijack (chalk/debug)); 3 critical advisories (Go, npm). What to patch and who can relax."
type: security-digest-day
section: "Security Digest"
date_published: 2025-09-08
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: September 8, 2025

1 editorial brief and 3 critical advisories.

## Take stock

- Most can relax: qix npm account hijack (chalk/debug) . Teams that built and shipped a browser bundle (especially a web3 or wallet-connected front end) with dependencies resolved on Sep 8, 2025, during the window, and anyone whose lockfile still pins a listed version.
- npm: 2 critical advisories ( @akoskm/create-mcp-server-stdio , codeceptjs ). Check with npm audit (or: npm ls <package>) .
- Go: 1 critical advisory ( github.com/prest/prest/v2 ). Check with govulncheck ./... .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Editorial briefs

- **Most can relax** [chalk, debug and 16+ npm Packages Hijacked via Phishing](https://erroneo.us/security/briefs/chalk-debug-npm-qix-phishing-hijack/index.md): Despite billions of weekly downloads, the bad versions were live for about two hours and the payload only swapped crypto addresses inside browsers, so most teams just need to confirm no lockfile or bundle captured them.

## Known exploited (CISA KEV)

None.

## Critical advisories

- [CVE-2025-58450](https://erroneo.us/security/cve/CVE-2025-58450/index.md) pREST has a Systemic SQL Injection Vulnerability — Go github.com/prest/prest/v2 < 2.0.0-rc2 → no fix
- [CVE-2025-54994](https://erroneo.us/security/cve/CVE-2025-54994/index.md) @akoskm/create-mcp-server-stdio is vulnerable to MCP Server Command Injection through `exec` API — npm @akoskm/create-mcp-server-stdio < 0.0.13 → 0.0.13
- [CVE-2025-57285](https://erroneo.us/security/cve/CVE-2025-57285/index.md) CodeceptJS's incomprehensive sanitation can lead to Command Injection — npm codeceptjs >= 3.5.0, < 3.7.5 → 3.7.5

---
Source page: https://erroneo.us/security/2025-09-08/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt