345 matches found
MAL-2025-143114 Malicious code in gulp-cluster-chalk-phoenix (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f68d6adcdba26daeeb1c108de5db41a2f44f387d2a858d78207f3204892fc6cd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-140643 Malicious code in chalk-ignite-polaris-puppeteer (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fe54ef9c61fe29b0ec4ddb152fb7d650282d6a50b1ec8cfc5a45af0115c4b198 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-121089
Malicious code in typeorm-chalk-eslint-config-geckodriver npm...
EUVD-2025-114425
Malicious code in dorado-chalk-canopus-exec npm...
EUVD-2025-35794
Malicious code in chalk-ipheriv npm...
Malicious Package
Overview chalk-ipheriv is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
Malicious code in chalk-ipheriv (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 14aef23722696ac10bcadbe24bba51c3dbdc0e9b1e0aa9477a91bc90d59cd48b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2025-48591 Malicious code in chalk-ipheriv (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 14aef23722696ac10bcadbe24bba51c3dbdc0e9b1e0aa9477a91bc90d59cd48b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
When Dependencies Turn Dangerous: Responding to the NPM Supply Chain Attack
On September 8, 2025, attackers compromised a set of 18 widely used npm packages —including chalk, debug, ansi-styles, and strip-ansi—collectively downloaded over 2.6 billion times per week. Through a targeted phishing campaign against a maintainer, the attackers published malicious versions...
Widespread npm Supply Chain Attack: Breaking Down Impact & Scope Across Debug, Chalk, and Beyond
A deeper look at the npm debug/chalk supply-chain incident: deobfuscating the wallet-hijacking browser interceptor, quantifying the 2-hour exposure with Wiz telemetry 99% package prevalence, 10% malware presence, and unpacking what made it spread so fast...
Malicious code in chalk-template (npm)
The package was compromised and malicious code added. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d822fb27286b8e6907df0e40f16e8722d81c16e24c35455be3d6d248d25b55ad Any computer that has this package installed or running should be considered fully compromised. All...
MAL-2025-46970 Malicious code in chalk-template (npm)
The package was compromised and malicious code added. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d822fb27286b8e6907df0e40f16e8722d81c16e24c35455be3d6d248d25b55ad Any computer that has this package installed or running should be considered fully compromised. All...
Malicious code in chalk (npm)
The package was compromised and malicious code added. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 985b6546ed08c8482326a4819faec318c27c1f6d7518acdf384d5f5a8c1453aa Any computer that has this package installed or running should be considered fully compromised. All...
MAL-2025-46969 Malicious code in chalk (npm)
The package was compromised and malicious code added. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 985b6546ed08c8482326a4819faec318c27c1f6d7518acdf384d5f5a8c1453aa Any computer that has this package installed or running should be considered fully compromised. All...
npm Packages With 2 Billion Weekly Downloads Hacked in Major Attack
Aikido Security flagged the largest npm attack ever recorded, with 18 packages like chalk, debug, and ansi-styles hacked…...
Embedded Malicious Code
Overview chalk-template is a Terminal string styling with tagged template literals Affected versions of this package are vulnerable to Embedded Malicious Code. This package version contains malicious code that monitors network traffic when run in a browser and targets crypto transactions. The...
Malicious code in chalk-fusion-cladistics-ignite (npm)
The package chalk-fusion-cladistics-ignite was found to contain malicious code...
Malicious code in auth0-chalk-redis-command (npm)
The package auth0-chalk-redis-command was found to contain malicious code...