346 matches found
MAL-2025-140650 Malicious code in chalk-miranda-stream-ursa (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c49e37c6859cc4ea8aaa71c43a84df6a1e639a482bc71eac042856a46b547299 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-139579 Malicious code in ariel-atlas-xenon-chalk (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 298a7f623be47cabfd451de0a2eb32a0918b75e3f951f41a55748b9cc25d60b7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-143114 Malicious code in gulp-cluster-chalk-phoenix (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f68d6adcdba26daeeb1c108de5db41a2f44f387d2a858d78207f3204892fc6cd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-144108 Malicious code in karma-ganymede-chalk-flare (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 819f1a214fd0d4e2d68030032a4a8261353707da867a164d5a15d4ad38aedf67 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-113674
Malicious code in fetch-chalk-mysql-ganymede npm...
EUVD-2025-123631
Malicious code in pm2-airbnb-rollup-chalk npm...
EUVD-2025-35794
Malicious code in chalk-ipheriv npm...
Malicious code in chalk-ipheriv (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 14aef23722696ac10bcadbe24bba51c3dbdc0e9b1e0aa9477a91bc90d59cd48b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious Package
Overview chalk-ipheriv is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
MAL-2025-48591 Malicious code in chalk-ipheriv (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 14aef23722696ac10bcadbe24bba51c3dbdc0e9b1e0aa9477a91bc90d59cd48b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
When Dependencies Turn Dangerous: Responding to the NPM Supply Chain Attack
On September 8, 2025, attackers compromised a set of 18 widely used npm packages —including chalk, debug, ansi-styles, and strip-ansi—collectively downloaded over 2.6 billion times per week. Through a targeted phishing campaign against a maintainer, the attackers published malicious versions...
Widespread npm Supply Chain Attack: Breaking Down Impact & Scope Across Debug, Chalk, and Beyond
A deeper look at the npm debug/chalk supply-chain incident: deobfuscating the wallet-hijacking browser interceptor, quantifying the 2-hour exposure with Wiz telemetry 99% package prevalence, 10% malware presence, and unpacking what made it spread so fast...
MAL-2025-46970 Malicious code in chalk-template (npm)
The package was compromised and malicious code added. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d822fb27286b8e6907df0e40f16e8722d81c16e24c35455be3d6d248d25b55ad Any computer that has this package installed or running should be considered fully compromised. All...
Malicious code in chalk-template (npm)
The package was compromised and malicious code added. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d822fb27286b8e6907df0e40f16e8722d81c16e24c35455be3d6d248d25b55ad Any computer that has this package installed or running should be considered fully compromised. All...
Malicious code in chalk (npm)
The package was compromised and malicious code added. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 985b6546ed08c8482326a4819faec318c27c1f6d7518acdf384d5f5a8c1453aa Any computer that has this package installed or running should be considered fully compromised. All...
MAL-2025-46969 Malicious code in chalk (npm)
The package was compromised and malicious code added. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 985b6546ed08c8482326a4819faec318c27c1f6d7518acdf384d5f5a8c1453aa Any computer that has this package installed or running should be considered fully compromised. All...
npm Packages With 2 Billion Weekly Downloads Hacked in Major Attack
Aikido Security flagged the largest npm attack ever recorded, with 18 packages like chalk, debug, and ansi-styles hacked…...
Embedded Malicious Code
Overview chalk-template is a Terminal string styling with tagged template literals Affected versions of this package are vulnerable to Embedded Malicious Code. This package version contains malicious code that monitors network traffic when run in a browser and targets crypto transactions. The...