NPM-QIX-CHALK-DEBUG-2025
npm · chalk, debug, ansi-styles, strip-ansi, color-convert (+13 more)
Summary
On 8 September 2025, the largest npm supply-chain attack ever by sheer reach hit foundational packages, chalk, debug, ansi-styles, strip-ansi, and 14 more, that together are downloaded over 2 billion times a week. The cause was a single phishing email. A respected maintainer was tricked by a fake "your npm 2FA is expiring" message into handing over his account, and the attackers published poisoned versions of his ultra-popular libraries. The payload was a crypto clipper: browser code that silently swapped any cryptocurrency address a user was sending to with the attacker's. Automated scanners flagged the poisoned versions within minutes and they were pulled within about two hours, and the actual theft came to roughly a thousand dollars, the one piece of good news in an attack that sat, briefly, under nearly the entire JavaScript ecosystem.
How it happened
It began with phishing. The maintainer Josh Junon, known as "Qix," received a convincing fake email from the spoofed domain support@npmjs.help (registered just three days before the attack), warning that his npm two-factor authentication was expiring and that he needed to re-authenticate. He did, and handed the attackers his account. They immediately published malicious versions of 18 of his foundational packages (chalk@5.6.1, debug@4.4.2, ansi-styles@6.2.2, and more) which collectively account for over 2 billion weekly downloads, making this the largest npm supply-chain attack by volume in history.
The payload was a browser-based crypto clipper. It hooked the browser's fetch and XMLHttpRequest, used fuzzy (Levenshtein-distance) matching to swap a victim's intended cryptocurrency address with a look-alike attacker address across Ethereum, Bitcoin, Solana, Tron, Litecoin, and Bitcoin Cash, hijacked MetaMask transactions through window.ethereum, and even rewrote transaction parameters on DeFi front-ends like Uniswap and PancakeSwap before the user signed. The effect: a user sending crypto on any affected web app would have their destination address quietly rewritten to the attacker's, in transit, without noticing.
The damage
Despite the staggering reach, the actual theft was tiny: on-chain trackers put it at roughly $1,000 total, with only about $500 left in the attacker's wallet and the ETH actually clipped amounting to about five cents. That tiny number came down to several things: automated malware scanners caught the poisoned versions within minutes (the packages were live about two hours before cleanup, not two hours before anyone noticed), the clipper only affected browser-based crypto flows so servers and CI pulling the bad versions were not drained, and the crypto industry reacted fast, Ledger's CTO publicly urged users to halt on-chain transactions. It was a near-miss of historic proportions: the same access could have shipped a far more destructive payload, a credential stealer or a wiper, to nearly the entire JavaScript ecosystem. It became the canonical "one phished maintainer, two billion downloads" story.
Why qix-chalk still matters
It lays bare the asymmetry of npm: a single maintainer's account sits in front of billions of installs, and the only thing guarding it is often a phishable second factor. The small payload and quick detection were luck, not design. The lessons are sharp: use phishing-resistant 2FA (FIDO2 or passkeys), which is un-phishable and would have defeated the fake "2FA reset" trick that ordinary one-time codes could not; train maintainers to distrust "your account is expiring, re-authenticate now" emails and to check the real domain rather than the link; pin dependencies and avoid auto-adopting brand-new releases of core libraries; and watch for unexpected versions. It is a same-year sibling of the self-replicating Shai-Hulud worm.
How to fix it
- Pin to or roll back to known-good versions of the affected packages and rebuild from a clean lockfile.
- For web apps that served a poisoned version, treat it as a client-side compromise: warn users and audit any crypto transactions made during the window.
- The maintainer, and anyone hit by the same lure, must reset credentials and move to phishing-resistant 2FA.
How to avoid it
- Use phishing-resistant 2FA (FIDO2 or passkeys) on package-publishing accounts; the fake "2FA reset" lure that worked here cannot defeat a hardware key.
- Train maintainers to distrust "your account is expiring / re-authenticate now" emails and to verify the real domain, not the link.
- Pin dependencies and do not auto-adopt brand-new releases of core libraries; a two-hour-poisoned version should never flow straight into your build.
- Monitor for unexpected new versions of critical packages and pull from a vetted internal mirror.
References
- https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised
- https://socket.dev/blog/npm-author-qix-compromised-in-major-supply-chain-attack
- https://info.arkm.com/research/npm-attack-hacker-javascript-supply-chain-500-2025
- https://www.stepsecurity.io/blog/20-popular-npm-packages-compromised-chalk-debug-strip-ansi-color-convert-wrap-ansi
Related vulnerabilities
All Supply chain →- CRITICALSC-KASEYA-VSA-2021
On 2 July 2021, the Friday before the US holiday weekend, the REvil ransomware gang exploited a chain of zero-day flaws in Kaseya VSA, starting with CVE-2021-30116 (an unauthenticated credential leak), in a remote-monitoring-and-management tool used by managed service providers. By abusing VSA's trusted software-deployment mechanism, REvil pushed its encryptor through roughly 50 to 60 MSPs down to about 1,500 of their downstream business customers in one cascading supply-chain hit, including Sweden's Coop grocery chain, which closed about 800 stores. REvil demanded $70 million for a universal decryptor; a decryptor key was ultimately obtained and distributed without payment. It is the lesson that the management tools with the most reach are the highest-value targets and need the strongest controls.
- HIGHSC-CCLEANER-2017
In September 2017, Cisco Talos revealed that CCleaner, a hugely popular Windows cleanup tool from Piriform (newly acquired by Avast), had been shipping a backdoor. Attackers had compromised Piriform's build environment and inserted malicious code into the official, validly code-signed installer, so version 5.33 distributed through Piriform's own channels carried the malware to about 2.27 million users for roughly a month before anyone noticed. The first stage merely profiled machines, but it was a sniper rather than a shotgun: from the millions of installs it served a second stage to only a few dozen selected computers at companies like Google, Microsoft, Cisco, Intel, and Samsung, and a still deeper espionage tool (the ShadowPad backdoor) was later found planted on Piriform's own internal machines. The attack is linked to the China-nexus group tracked as APT17 / Axiom. It is the lesson that a trusted update channel and a valid signature are not the same as trustworthy code, and that build pipelines are prime targets.
- CRITICALGHSA-93qj-5q5v-3c2h
Trojanized pantheon-agents 0.6.1 and 0.6.2 on PyPI ship a credential stealer (supply-chain account compromise)
- CRITICALNPM-REDHAT-MIASMA-2026
In June 2026 the npm supply-chain worm finally produced something genuinely new and frightening: malicious packages that were signed and carried valid build provenance. Attackers used a compromised GitHub account inside Red Hat's own organisation to publish trojanised versions of 31 packages in the @redhat-cloud-services namespace through Red Hat's legitimate CI pipeline, so the poisoned releases arrived with authentic attestations proving they were built by the real build system. The payload, nicknamed Miasma, was a lightly re-skinned copy of Mini Shai-Hulud, a worm that a group called TeamPCP had open-sourced for anyone to reuse weeks earlier. No Red Hat customers were harmed, because Red Hat strips install scripts before deployment, but the permanent lesson is uncomfortable: a signature proves where a package was built, not that the build was clean.
- CRITICALNPM-AXIOS-2026
On 31 March 2026 the single most widely used HTTP client in the JavaScript world was turned into malware for about three hours. Axios carries well over 100 million weekly downloads and sits as a transitive dependency underneath a huge share of the npm ecosystem, so when a North Korea-nexus actor took over the maintainer's account and published two booby-trapped versions, the blast radius was enormous even though the bad versions were live only for one early-morning window. The poisoned releases pulled in a hidden dependency that ran on install and dropped a cross-platform remote access trojan onto developer machines and CI runners. It is the case study in why a few hours of a popular package being compromised is still a global incident, and in why a maintainer's own laptop is now a nation-state target.
- HIGHSC-NOTEPADPP-CHRYSALIS-2025
In 2025, a Chinese state-linked espionage group hijacked the update channel of Notepad++, one of the most widely installed Windows text editors, to plant a custom backdoor on a handful of carefully chosen targets. The attackers never touched Notepad++'s source code or its signing keys. Instead they compromised the third-party shared-hosting server that delivered updates, and abused the fact that the WinGUp updater shipped without any integrity check on what it downloaded (tracked as CVE-2025-15556). For machines on their target list, WinGUp was silently redirected to attacker-controlled servers that served a trojanized installer; everyone else kept receiving the genuine update. The campaign ran from roughly June to December 2025 and was only made public in February 2026 by Rapid7, with Kaspersky and Broadcom/Symantec corroborating it independently.