The chalk and debug npm Compromise Explained

Video transcript

On September 8, 2025, the chalk and debug npm packages shipped code that tried to redirect crypto payments in browsers. It began with one fake email.

An email from the lookalike domain npmjs dot help asked maintainer Josh Junon to update his two-factor authentication. The attacker took his login and published malicious versions.

Aikido counted 18 packages with more than 2 billion weekly downloads between them.

The code ran only in browsers. It hooked wallet and network calls, swapped in look-alike attacker addresses across six chains, and altered transactions before signing.

Detection was fast. Aikido flagged it at 13:16 UTC, and npm took down all impacted versions that day.

Exposure was narrow. Per Privy's Andrew MacPherson, an app needed a fresh install and lockfile in the attack window, plus a vulnerable dependency. The sources give no loss figure.

Servers and command line tools were not affected. Inspect the browser bundle you shipped, and verify the address your wallet itself shows.

Search your lockfiles for the bad versions. Then, per GitHub's advisory, upgrade, delete node modules, clean caches and rebuild your browser bundles.

An SDK ships its dependencies to every integrator. Guardian's SDK Audit reviews the published artifact, what it hands the wallet, and who can publish.

Read the full article, or talk to Guardian about what your SDK ships to integrators.

The chalk package colors terminal text, and debug prints debug logs. Aikido listed them at about 300 million and 358 million weekly downloads.

Neither has anything to do with crypto. On September 8, 2025, both shipped code that tried to redirect crypto payments in the browser.

BleepingComputer later revised its lede because the attack "is not as impactful as initially thought," its update note says. Here is what the sources confirm.

What Happened

The maintainer, Josh Junon (qix), received an email from support at npmjs[.]help, a lookalike of npm's domain, BleepingComputer reported.

It said accounts with outdated 2FA credentials would be temporarily locked from September 10, 2025. It asked him to update his two-factor authentication.

Junon later wrote on GitHub that it "looked shockingly authentic."

Aikido says the npmjs[.]help domain was registered on September 5, three days before the attack.

The lookalike site sent login details to the attacker, and malicious package versions followed. Other maintainers received the same email, BleepingComputer reported.

The packages

Aikido listed 18 packages with more than 2 billion weekly downloads between them:

The maintainer's own list on the debug GitHub issue also names color 5.0.1.

How the Payload Worked

The code ran in the browser, "on the client of a website," as Aikido put it.

GitHub's advisory for debug says local, server and command line environments are not affected. Browser bundles built with the bad version "will need to be rebuilt."

Aikido's analysis of the payload found that it:

• Wrapped window.ethereum, fetch and XMLHttpRequest, and handled Solana wallet methods.
• Checked whether a wallet was connected.
• Scanned requests and responses for wallet addresses.
• Swapped them for look-alike attacker addresses, using string matching to hide the change.
• Altered Ethereum and Solana transactions before signing, including recipients and approvals.
• Covered Ethereum, Bitcoin, Bitcoin Cash, Litecoin, Tron and Solana.

Funds and approvals could be "redirected to attacker-controlled accounts without any obvious signs to the user," Aikido wrote.

Timeline and Impact

Times are UTC on September 8, 2025, unless noted. Junon's times come from his updates on the debug GitHub issue.

For an app to be affected, MacPherson listed three conditions, BleepingComputer reported:

• A fresh install between about 9 and 11:30 a.m. ET.
• A package-lock.json created during that time.
• Vulnerable packages in direct or transitive dependencies.

Even then, the code "only impacts individuals accessing the compromised applications over the web," BleepingComputer noted.

None of Aikido, BleepingComputer or GitHub's advisories gives a figure for stolen funds.

What It Shows

Any dependency can reach the wallet. Packages for terminal colors and debug logs ended up rewriting transaction recipients in browsers.

A lookalike domain was enough. One convincing email took over an account behind packages with more than 2 billion weekly downloads, by Aikido's count.

Our npm supply chain guide covers phishing-resistant 2FA and trusted publishing.

Lockfiles narrowed the exposure. By MacPherson's conditions, apps built from a lockfile created before the window did not pull the bad versions.

Detection was fast. Aikido's feed alerted at 13:16 UTC, and the maintainer was cleaning up two hours later.

Server checks miss browser code. The payload ran only in browsers, so the shipped bundle is what to inspect and rebuild.

The wallet prompt is the last check. The payload changed transactions before signing, so the address to verify is the one the wallet itself shows.

Other npm incidents in this series: the axios npm attack and the Ledger Connect Kit attack.

How SDK Audit Tests This

Neither chalk nor debug is an SDK. But an SDK ships its dependencies to every integrator.

Guardian's SDK Audit reviews what a library does with a payload and "what one bad release would do," its service page says. Three of its six areas apply:

• Published artifact: what ships to the registry versus the repo, including install scripts and dependencies.
• Transaction construction: what the SDK hands the wallet, and whether it matches the requested call.
• Release control: who can publish, whether 2FA and provenance are enforced, how a bad version gets pulled.

Guardian reviews both the source and the published package. Its page says "the gap between them is where supply-chain risk lives."

The audit covers TypeScript, Python, Rust, Go and JVM client libraries for EVM and Solana. It is scoped by the public surface and the release pipeline.

After release, Managed Security matches new vulnerability disclosures against what you run. Where one reaches you, an engineer confirms the exposure and works with you on the patch.

For the wider offchain scope, read web3 penetration testing explained.

Frequently Asked Questions

Which chalk and debug versions were malicious?

Version 5.6.1 of chalk and 4.4.2 of debug. Aikido listed 16 more, such as ansi-styles 6.2.2, and the maintainer's list adds color 5.0.1. npm took the bad versions down on September 8. The fixed debug release is 4.4.3.

Did it affect servers or command line tools?

No. GitHub's advisory for debug says local, server and command line environments are not affected. Browser bundles built with the bad versions could still carry the malware and need to be rebuilt.

How much was stolen?

No source we read gives a loss figure. BleepingComputer later revised its lede because the attack was not as impactful as first thought.

What should teams check now?

Search lockfiles for the bad versions. Then follow GitHub's advisory: upgrade, delete node_modules, clean package manager caches and rebuild browser bundles. Aikido also advises a lockfile and pinned versions.

Sources

• Aikido: npm debug and chalk packages compromised (September 8, 2025)
• BleepingComputer: Hackers hijack npm packages with 2 billion weekly downloads in supply chain attack (September 8, 2025, lede later revised)
• GitHub Advisory Database: debug@4.4.2 contains malware after npm account takeover, GHSA-4x49-vf9v-38px (September 15, 2025)
• GitHub Advisory Database: Malware in chalk, GHSA-2v46-p5h4-248w (September 8, 2025)
• NIST NVD: CVE-2025-59144 (September 15, 2025)
• GitHub, debug-js/debug: Version 4.4.2 published to npm is compromised, issue #1005 (September 8, 2025)
• Guardian: SDK Security Audit for EVM and Solana