The Sept 2025 npm Supply Chain Attack: chalk, debug & Crypto Stealers

Primary write-ups from Aikido Security, Snyk, and Sonatype agree on the core facts: attackers gained publishing rights to the ~qix npm account and shipped malicious versions of utility packages including [email protected], [email protected], [email protected], [email protected], [email protected], and related ANSI/color helpers. Aikido reported the set at 18 packages with more than 2 billion combined weekly downloads — a measure of ecosystem reach, not a count of infected end users.

Sonatype later tracked additional packages (including some duckdb / prebid-related publishes) under the same campaign IDs. Always verify against current advisory lists when remediating — the exact set expanded in the first 24–48 hours.

Condensed from Snyk’s published timeline:

• ~13:00 — First detected malicious publishes
• 13:16 — Aikido intel feed alerts on malicious packages
• 14:16 — Maintainer alerted on social platforms
• 15:16 — Compromise confirmed; npm notified
• 17:17 — npm acknowledges and works removals
• 19:59 — npm reports impacted versions taken down

Phishing lure details reported across industry blogs: emails impersonating npm support from the lookalike domain npmjs.help, with urgency around account lockouts. That is social engineering against a high-value maintainer — not a novel npm protocol flaw.

Aikido and follow-on analyses describe obfuscated browser JavaScript that:

• Hooks fetch and XMLHttpRequest to inspect network responses
• Hooks wallet APIs such as window.ethereum (and related web3 surfaces)
• Rewrites payment / approval destinations toward attacker-controlled addresses before signing

The malware stayed dormant unless crypto/web3 activity appeared in the browser context. That selectivity helped explain why many Node CLI users saw nothing unusual while crypto front-ends faced the real theft risk.

Despite the download headlines, reported realized theft was small. CSO Online quoted Aikido’s Charlie Eriksen tracking approximately $970 to attacker wallets; Sygnia’s advisory summarized losses around $500. Treat those as reported ranges, not audited totals. Hardware-wallet users who verified destinations on-device remained largely protected against silent UI swaps.

Download volume is not victim count. Most installs never executed the browser payload in a wallet context during the short live window.

1. Diff lockfiles against known bad versions listed by Aikido / Snyk / Sonatype
2. Search built JS for the IOC marker shared by Sindre Sorhus: _0x112fa8
3. Pin to known-good versions, wipe node_modules and CI caches, clean rebuild front-end bundles
4. If you ship crypto UI, audit on-chain activity for the incident window
5. Rotate npm tokens / GitHub PATs if there is any chance they were exposed on a compromised maintainer machine

VanishingVault does not stop supply-chain malware. Dependency scanning, lockfiles, trusted publishing, and phishing-resistant MFA for maintainers do. Secret-sharing hygiene still matters at the edges of the same incident class:

• Do not paste npm tokens, cloud keys, or seed phrases into Slack/email forever
• Hand credentials to teammates with a one-time encrypted link instead of a persistent chat paste
• Keep long-lived machine secrets in a vault / OIDC flow — see API key management vs one-time secrets

Later 2026 campaigns (worms, CI hijacks, other namespace takeovers) continue the same theme: registry trust is brittle. This article stays anchored on the Sept 8, 2025 chalk/debug incident because inventing breach counts across every follow-on campaign helps nobody.