npm Supply-Chain Compromise (chalk/debug + 17 packages, Sept 2025) — Motivates GitHub Dependabot 'Cooldown' Mitigation — Threadlinqs Intelligence
As of 2026-07-27, npm Supply-Chain Compromise (chalk/debug + 17 packages, Sept 2025) — Motivates GitHub Dependabot 'Cooldown' Mitigation is a high-severity supply chain threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 35 indicators of compromise.
Threat ID: TL-2026-1714 · Severity: HIGH · Status: RESOLVED · Category: SUPPLY_CHAIN
On 2025-09-08, a phishing attack against npm maintainer Josh Junon ('Qix') led to malicious, wallet-hijacking versions of chalk, debug, and 17 other packages (>2B combined weekly downloads) being
On September 8, 2025 at approximately 13:00 UTC, an attacker sent a convincing 2FA-reset phishing email from the fraudulent domain npmjs[.]help to Josh Junon (npm handle 'Qix'), maintainer of the widely depended-upon chalk and debug packages. The email harvested Junon's npm credentials and a live TOTP code, giving the attacker full control of the account within minutes. At 13:16 UTC — roughly 16 minutes after compromise — the attacker began publishing trojanized versions of 18-19 high-traffic npm packages (chalk, debug, ansi-styles, ansi-regex, strip-ansi, wrap-ansi, slice-ansi, has-ansi, color-convert, color-string, color-name, color, simple-swizzle, is-arrayish, backslash, error-ex, supports-color, supports-hyperlinks, chalk-template), which collectively receive over 2 billion weekly downloads.
The injected payload was heavily obfuscated JavaScript that activated only in browser execution contexts (it deliberately no-opped in Node.js/server environments to reduce detection, occasionally throwing 'ReferenceError: fetch is not defined' during server-side builds — an incidental detection signal). In-browser, it hooked fetch(), XMLHttpRequest, window.ethereum.request, and Solana signing calls, then silently rewrote outbound cryptocurrency transaction recipients and token-approval targets to attacker-controlled wallet addresses across Ethereum, Bitcoin, Solana, Tron, Litecoin, and Bitcoin Cash. To evade visual inspection, the malware used Levenshtein-distance address substitution to select look-alike attacker addresses resembling the legitimate recipient, and specifically targeted ERC-20 function selectors for approve, transfer, transferFrom, and permit. A global object named window.stealthProxyControl was used to coordinate the hooked behavior, and a remote WebSocket endpoint (websocket-api2.publicvm[.]com) alongside two BunnyCDN-hosted domains (static-mw-host.b-cdn[.]net, img-data-backup.b-cdn[.]net) served as supporting infrastructure.
The community first raised suspicion around 14:16-15:20 UTC via Bluesky/GitHub; Junon publicly acknowledged the compromise at ~15:15-15:16 UTC. npm began takedown at 17:17 UTC, and all impacted chalk versions were removed from the registry by 19:59 UTC, with residual malicious versions of other packages cleaned up September 9. JFrog subsequently reported the campaign's scope extended beyond Qix's own packages. Despite the massive reach (an estimated 99% of scanned cloud environments contained at least one affected package pre-attack, ~10% contained the malicious code post-distribution), actual reported cryptocurrency theft was minimal given the short ~2-hour live window and rapid community detection.
Almost eleven months later, Help Net Security (2026-07-27) reports that GitHub has shipped a Dependabot 'cooldown' option (configurable via the `cooldown` key in `dependabot.yml`) that delays non-security dependency-update pull requests by a default window (the article cites 3 days) so that malicious package versions have time to be flagged by the community before automated tooling (including Dependabot itself) proposes the update. Security updates for known vulnerabilities bypass the cooldown. GitHub's Advisory Database recorded over 6,500 npm malware advisories in the year ending May 2026 (~18/day), underscoring that this chalk/debug incident is illustrative of an ongoing, high-frequency npm malicious-package problem rather than an isolated event.
Weaknesses (CWE)
CWE-506, CWE-829
Target sectors: technology, software-development, financial-services
Target regions: Global
Detections & IOCs
As of 2026-07-27, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 35 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
SUPPLY_CHAIN, HIGH, threat intelligence, cybersecurity, T1589, T1593, T1583, T1585, T1583, T1587, T1608, T1199, T1566, T1195