Malware injected into popular npm packages

In early September 2025, an attacker successfully compromised popular npm packages by phishing a well-known maintainer - Josh Junon. The attacker published malicious versions of widely used libraries such as chalk and debug, together responsible for billions of downloads every week. The injected code attempts to hijack network traffic and cryptocurrency wallet APIs, potentially redirecting transactions to attacker-controlled wallets.

What happened

8 Sep 2025: Maintainer phished via spoofed npm support; malicious releases published to multiple packages.
8–9 Sep 2025: Some versions were yanked or re-published; others remained available for hours.
Payload: hooks network and wallet APIs (e.g., fetch, XMLHttpRequest, window.ethereum, Solana RPC) and can redirect crypto transactions.

Affected packages & versions

If any of these exact versions are present in your project, CI image, or caches, assume compromise and move to remediation.

ansi-styles 6.2.2
debug 4.4.2
chalk 5.6.1
supports-color 10.2.1
strip-ansi 7.1.1
ansi-regex 6.2.1
wrap-ansi 9.0.1
color-convert 3.1.1
color-name 2.0.1
is-arrayish 0.3.3
slice-ansi 7.1.1
color 5.0.1
color-string 2.1.1
simple-swizzle 0.2.3
supports-hyperlinks 4.1.1
has-ansi 6.0.1
chalk-template 1.1.1
backslash 0.2.1

Who is at risk

Applications that bundle these utilities into browser or Electron code are most exposed, since the payload targets web and wallet APIs. Pure Node-only backends are lower risk but should still be rebuilt from clean dependencies.

Check & fix (5-minute version)

Freeze deploys if you installed or rebuilt between 8–9 Sep 2025.

Detect quickly
IoC scan (string _0x112fa8):

rg -uu --max-columns=80 "_0x112fa8" node_modules ~/.npm ~/.cache/pnpm ~/Library/Caches/Yarn

Check versions in your tree:

npm ls ansi-styles debug chalk supports-color strip-ansi ansi-regex wrap-ansi color-convert color-name is-arrayish slice-ansi color color-string simple-swizzle supports-hyperlinks has-ansi chalk-template backslash

Clean & reinstall

rm -rf node_modules package-lock.json pnpm-lock.yaml yarn.lock
npm cache clean --force && pnpm store prune || true
npm ci   # or: pnpm i --frozen-lockfile / yarn install --frozen-lockfile

Bump past bad versions, rebuild and redeploy from scratch. If your app touches crypto/wallet flows, review transactions from 8–9 Sep.
Rotate tokens & audit npm/GitHub/CI publish creds and logs.

BaseFortify for SMBs

There are no CVE IDs yet for these malicious releases. In BaseFortify you can still stay ahead by creating a watch list:

Add the components below (vendor: npm, product: package name, version: the compromised version) to a Node in My Components.
When CVEs or advisories are published, BaseFortify will automatically surface matches in My Threats and guide remediation.

Not using BaseFortify yet? Create a free account to try the watch list, or request a demo and we’ll set up a sample node for you.

Components to add today

npm / ansi-styles / 6.2.2
npm / debug / 4.4.2
npm / chalk / 5.6.1
npm / supports-color / 10.2.1
npm / strip-ansi / 7.1.1
npm / ansi-regex / 6.2.1
npm / wrap-ansi / 9.0.1
npm / color-convert / 3.1.1
npm / color-name / 2.0.1
npm / is-arrayish / 0.3.3
npm / slice-ansi / 7.1.1
npm / color / 5.0.1
npm / color-string / 2.1.1
npm / simple-swizzle / 0.2.3
npm / supports-hyperlinks / 4.1.1
npm / has-ansi / 6.0.1
npm / chalk-template / 1.1.1
npm / backslash / 0.2.1

Supply-chain incidents unfold quickly; recovery should be faster. Keep lockfiles pinned, use phishing-resistant MFA for publisher accounts, and add the components above to a Node watch list so BaseFortify can alert you as CVEs and advisories land. Not yet a user? Create a free account or request a demo.