--- title: npm debug and chalk packages compromised | daily.dev description: Popular npm packages including debug and chalk were compromised with malicious code that intercepts cryptocurrency transactions in browsers. The malware... canonical: https://daily.dev/posts/npm-debug-and-chalk-packages-compromised-lmfzrqfvw twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: npm debug and chalk packages compromised | daily.dev og:description: Popular npm packages including debug and chalk were compromised with malicious code that intercepts cryptocurrency transactions in browsers. The malware... og:url: https://daily.dev/posts/npm-debug-and-chalk-packages-compromised-lmfzrqfvw og:image: https://api.daily.dev/og/posts/lMfZrQFvw.png og:image:alt: npm debug and chalk packages compromised og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # npm debug and chalk packages compromised **[Hacker News](https://daily.dev/sources/hn)** · 16 min read · 3 upvotes · 1 comments ## Summary Popular npm packages including debug and chalk were compromised with malicious code that intercepts cryptocurrency transactions in browsers. The malware hijacks wallet interactions, manipulates payment destinations, and redirects funds to attacker-controlled accounts. The attack affected 18 packages with millions of weekly downloads through a phishing email targeting the maintainer. The compromised code operates as a browser-based interceptor that hooks into network functions and wallet APIs to silently rewrite transaction targets. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Community discussion Top comments from developers on daily.dev. **@ncado** · 0 upvotes > wery appriciate daily dev for this, that actually help a lot!! --- Tags: [#security](https://daily.dev/tags/security), [#cyber](https://daily.dev/tags/cyber), [#crypto](https://daily.dev/tags/crypto), [#malware](https://daily.dev/tags/malware), [#npm](https://daily.dev/tags/npm) [View this post on daily.dev](https://daily.dev/posts/npm-debug-and-chalk-packages-compromised-lmfzrqfvw) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"npm debug and chalk packages compromised","url":"https://daily.dev/posts/npm-debug-and-chalk-packages-compromised-lmfzrqfvw","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/npm-debug-and-chalk-packages-compromised-lmfzrqfvw"},"datePublished":"2025-09-08T16:05:41.375Z","dateModified":"2025-09-09T16:49:34.992Z","description":"Popular npm packages including debug and chalk were compromised with malicious code that intercepts cryptocurrency transactions in browsers. The malware...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e37e142f8f7f47b97eff1b1016b99abf?_a=AQAEulh","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e37e142f8f7f47b97eff1b1016b99abf?_a=AQAEulh","isAccessibleForFree":true,"articleSection":"Hacker News","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Hacker News","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/hn","url":"https://daily.dev/sources/hn"},"commentCount":1,"discussionUrl":"https://daily.dev/posts/npm-debug-and-chalk-packages-compromised-lmfzrqfvw","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":3},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":1}],"keywords":"security,cyber,crypto,malware,npm","timeRequired":"PT16M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Hacker News","item":"https://daily.dev/sources/hn"},{"@type":"ListItem","position":3,"name":"npm debug and chalk packages compromised"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/npm-debug-and-chalk-packages-compromised-lmfzrqfvw","comment":[{"@type":"Comment","text":"wery appriciate daily dev for this, that actually help a lot!!","datePublished":"2025-09-09T09:06:32.154Z","url":"https://daily.dev/posts/lMfZrQFvw#c-twnEYwsp3","author":{"@type":"Person","name":"Vitaliy Mistrakov","url":"https://daily.dev/ncado","image":"https://lh3.googleusercontent.com/a/ACg8ocKdck58xSUT7BO2oTPxrsdJjVElvamxhm5O98lwU2q8=s96-c"}}]} ```