Supply-chain attacksBriefChecked against a primary source
chalk/debug: Qix maintainer phished, 18 packages
Phishing domain npmjs.help. Malicious chalk 5.6.1, debug 4.4.2, ansi-styles 6.2.2, strip-ansi 7.1.1 and 14 others.
- Disclosed
What happened
- Scale: more than 2 billion combined weekly downloads (Aikido). Live about 2 hours.
- Payload: a browser crypto-drainer that swaps wallet addresses.
Sources
- https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised
- https://socket.dev/blog/npm-author-qix-compromised-in-major-supply-chain-attack
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.