20+ Popular NPM Packages Compromised (Chalk, Debug, Strip-ANSI, Color-Convert, Wrap-ANSI...)

The StepSecurity report reveals a massive NPM supply chain attack affecting over 20 widely-used packages, including chalk, debug, ansi-styles, color-convert, strip-ansi and more, with malicious versions published to steal cryptocurrency and redirect blockchain transactions. The incident stemmed from a targeted phishing attack on maintainer Josh Junon (Qix-), beginning on 8 January 2025, when a convincing 2FA reset email from npm support bypassed initial scrutiny.

The malware exhibited obfuscation and data exfiltration capabilities, with the malicious code able to detect cryptocurrency wallets, replace addresses across multiple blockchains, and hijack network calls to manipulate transactions on DeFi platforms such as Uniswap and PancakeSwap. The affected packages listed include ansi-styles 6.2.2, strip-ansi 7.1.1, ansi-regex 6.2.1, debug 4.4.2, color-convert 3.1.1, chalk 5.6.1, wrap-ansi 9.0.1, among others, with billions of weekly downloads noted.

Industry response credited to the security team at Aikido for first detecting and publicly reporting the compromise, enabling rapid community action; Sindre Sorhus helped publish clean versions and npm support initiated incident response.