npm chalk / debug maintainer phishing (Qix)

In September 2025 the npm account of maintainer Qix (Josh Junon) was
phished. Malicious versions of extremely widely used packages including
chalk and debug — and a fan-out of related packages — were published.
Payloads targeted crypto-wallet activity in consuming applications. This
is the same shape as ua-parser-js (AS11) and event-stream (AS9) at a
much larger package-popularity scale.

Mapped techniques

T0113 Compromised user account
T0109 Publish malicious artifact
T0121 Compromised legitimate artifact
T0159 Malicious artifact execution
T0139 Resource hijacking

supply-chain npm maintainer account

T0113 · Initial Access · Compromised user account

Phishing produced control of the maintainer npm identity.

T0109 · Resource Development · Publish malicious artifact

New versions of chalk, debug, and related packages were published
from the hijacked account.

T0121 · Resource Development · Compromised legitimate artifact

Downstream projects continued to resolve the same package names.

post-supply-chain Applications depending on chalk/debug

T0159 · Execution · Malicious artifact execution

Install or runtime of the poisoned versions executed attacker code.

T0139 · Impact · Resource hijacking

Reported objective was theft of cryptocurrency / wallet material.

Framework gaps noted

Phishing of high-degree npm maintainers is an initial-access path This catalogue still folds into T0113; a dedicated "registry phishing" procedure would help.

npm chalk / debug maintainer phishing (Qix)

Mapped techniques

supply-chain npm maintainer account

post-supply-chain Applications depending on chalk/debug

Framework gaps noted

Sources