chalk, debug and 16+ npm Packages Hijacked via Phishing

What to do

1. Search lockfiles for the listed versions: grep -nE '"(chalk|debug|ansi-styles|strip-ansi|supports-color|ansi-regex|wrap-ansi)"' -A2 package-lock.json, or npm ls chalk debug.
2. If any listed version appears, delete node_modules, run npm cache clean --force, reinstall from a corrected lockfile, and rebuild and redeploy front-end bundles built on Sep 8, 2025.
3. Purge the versions from internal registry proxies and CI caches.
4. Use lockfiles with npm ci in CI so a newly published version is not picked up silently.
5. Maintainers: use phishing-resistant 2FA (security keys) and treat any 2FA-reset email as suspect; npm will not ask you to update 2FA by email link.

How to check if you are affected or compromised

• npm ls chalk debug ansi-styles strip-ansi supports-color (and the other listed names) and compare against the version list.
• grep built JavaScript bundles deployed after Sep 8, 2025 for code hooking window.ethereum alongside rewritten fetch/XMLHttpRequest.
• For wallet-connected apps, review transactions initiated through the front end on Sep 8, 2025 for unexpected recipients or approvals.

What happened#

On September 8, 2025, the npm maintainer known as qix, who publishes a large set of foundational npm packages, received an email from support@npmjs.help. The email warned that the account's 2FA credentials were out of date and urged an "Update 2FA Now" click. Socket reports that the maintainer later confirmed on the debug issue tracker that the lure looked real and led to the takeover. The lookalike domain had been registered only days earlier, according to Aikido. Aikido's feed flagged malicious releases from 13:16 UTC. Socket puts the first wave at 13:12-13:16 UTC and a second at 13:19-13:20 UTC.

Eighteen packages were affected, with more than 2 billion weekly downloads combined. They include chalk 5.6.1, debug 4.4.2, ansi-styles 6.2.2, strip-ansi 7.1.1, supports-color 10.2.1, ansi-regex 6.2.1, wrap-ansi 9.0.1 and color-convert 3.1.1. The injected code runs in the browser. It hooks window.ethereum, fetch and XMLHttpRequest, finds wallet addresses for Ethereum, Solana, Bitcoin, Tron, Litecoin and Bitcoin Cash, and replaces them with attacker addresses. It also changes transaction recipients and approvals before the user signs. In the chalk issue, maintainer Sindre Sorhus said the compromised versions "were available for approximately 2 hours." He published clean releases such as chalk 5.6.2, and by evening European time npm had removed the infected versions.

Who is affected#

Only installs that resolved one of the listed versions during that short window, and that run in a browser where the payload can see wallet traffic. Socket counts 19 packages because it includes proto-tinker-wc, a later package with different code that appears to come from the same actor. Sources disagree on its version (Aikido says 0.1.87, Socket says 1.8.7). The same phishing campaign also caught DuckDB. Its advisory lists malicious duckdb, @duckdb/node-api and @duckdb/node-bindings 1.3.3 and @duckdb/duckdb-wasm 1.29.2, tracked as CVE-2025-59037. The maintainers write that "we fell for a classic phishing attack." No CVE was assigned to the qix packages themselves, and none of this is in CISA KEV.

Do you really need to act?#

Probably not. This was the largest npm takeover by download count, but the actual exposure was small. The window was about two hours. Most projects pin these packages deep in lockfiles, so a fresh resolution was needed to pick them up. The payload did nothing to Node servers, CI or developer laptops beyond the browser. In the chalk thread, researcher Adnan Khan said early indications showed no funds stolen. That is a community assessment, and a total loss figure was not disclosed as of 2026-10-21. The teams that should look closely are those that built and deployed a front end, especially a wallet-connected one, on September 8.

What to do now#

1. Run npm ls chalk debug ansi-styles strip-ansi supports-color (plus the other names) and check lockfiles for the exact versions listed.
2. If any appear, delete node_modules, run npm cache clean --force, fix the lockfile, and rebuild and redeploy affected bundles.
3. Purge the versions from Artifactory, Nexus or other proxies and from CI caches.
4. Use npm ci with committed lockfiles so new releases are not pulled in silently.
5. If you maintain packages, move to security-key 2FA and never follow a 2FA-reset link from email.

How to tell if you were hit#

A version check is enough for most teams. For bundles shipped on or after September 8, search the minified output for code that wraps window.ethereum and also replaces fetch or XMLHttpRequest. For dapps, compare transactions initiated through your site that day against what users intended.

Timeline#

• Sep 8, 2025 — The phishing email arrives. Malicious versions publish from about 13:12 UTC, Aikido flags them at 13:16 UTC, and npm removes them about two hours later per the maintainer. DuckDB is compromised the same day.
• Sep 9, 2025 — The chalk issue is marked resolved. DuckDB publishes GHSA-w62p-hx95-gf2c.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. chalk/chalk issue #656 — Version 5.6.1 published to npm is compromised github.com
2. Aikido — npm debug and chalk packages compromised aikido.dev
3. Socket — npm author Qix compromised in major supply chain attack socket.dev
4. DuckDB — GHSA-w62p-hx95-gf2c: malicious npm releases after phishing github.com