chalk, debug and 16 other npm packages: maintainer phished, wallet-hijacking malware published (CVE-2025-59144)
Severity: high · Patch status: patched · Since 2025-09-08 · CVE-2025-59144
On 2025-09-08 around 13:12 UTC an attacker who had phished the maintainer's npm credentials published malicious releases of 18 widely used npm packages (including chalk 5.6.1, debug 4.4.2, ansi-styles 6.2.2, strip-ansi 7.1.1). The maintainer says a lookalike 2FA-reset email from npmjs.help sent him to a fake login page that captured his password and one-time code; the attacker then changed the account email. The injected browser-side code hooked fetch, XMLHttpRequest and wallet providers (window.ethereum, Solana) and swapped destination addresses and approval parameters in crypto transactions for attacker-controlled ones. Anything that built a front-end bundle with a fresh install during the roughly two-hour window could have shipped the code; npm removed the versions that evening and clean replacements (for example chalk 5.6.2) followed within hours.
What to do
- Search lockfiles and built bundles for the 18 compromised versions (chalk 5.6.1, debug 4.4.2, ansi-styles 6.2.2, strip-ansi 7.1.1, ansi-regex 6.2.1, supports-color 10.2.1, wrap-ansi 9.0.1, slice-ansi 7.1.1, color-convert 3.1.1, color-name 2.0.1, color-string 2.1.1, is-arrayish 0.3.3, simple-swizzle 0.2.3, error-ex 1.3.3, has-ansi 6.0.1, supports-hyperlinks 4.1.1, chalk-template 1.1.1, backslash 0.2.1)
- Rebuild and redeploy any front-end artifact built between 2025-09-08 13:00 and ~20:00 UTC with a fresh install, using the fixed versions or an override/pin to the previous release
- Treat crypto transactions signed through affected front ends in that window as suspect and review approvals
- Set a minimum release age for new npm versions and require phishing-resistant (hardware key) 2FA on publisher accounts
Fixed versions
- chalk 5.6.2
- debug 4.4.3
- ansi-styles 6.2.3
- strip-ansi 7.1.2
- ansi-regex 6.2.2
- supports-color 10.2.2
- wrap-ansi 9.0.2
- slice-ansi 7.1.2
- has-ansi 6.0.2
- supports-hyperlinks 4.1.2
- chalk-template 1.1.2
Sources
All live incidents on Threat Watch
