# Widespread npm Supply Chain Attack: Breaking Down Impact & Scope Across Debug, Chalk, and Beyond

Social-engineered npm account takeover published malicious debug/chalk versions that injected a browser wallet-address clipper, diverting crypto recipients and ERC-20 approvals to attacker wallets.

- Payout: Real-world hack
- Severity: high
- Program: npm
- Credited: Wiz Research
- Disclosed: 2025-09-09
- Write-up quality: 7/10
- Original: https://www.wiz.io/blog/widespread-npm-supply-chain-attack-breaking-down-impact-scope-across-debug-chalk
- Library page: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-widespread-npm-supply-chain-attack-breaking-down-impact-scope-across-debug-chalk
- Tags: domain:oss domain:web3 impact:funds-loss impact:integrity kind:incident platform:threat-intel sev:high tech:nodejs technique:recon technique:source-review vuln:secrets-leak

**Target:** npm packages bundled into frontend JS; browser fetch/XHR and window.ethereum/Solana wallet APIs
**Root cause:** Attacker gained control of maintainer Qix's npm account via social engineering and published malicious versions of popular packages containing obfuscated code that hooks network and wallet APIs in the browser.
**Steps:**
1. Identify affected versions e.g. `debug@4.4.2`, `chalk@5.6.1`, `ansi-styles@6.2.2`, `@duckdb/node-api@1.3.3`
2. Search `package-lock.json`/`pnpm-lock.yaml`/`yarn.lock` and artifact registry for exact versions
3. Scan built JS bundles for obfuscated `_0x112fa8=_0x180f` string-array pattern
4. Check CDN/service-worker/browser caches for tainted assets served during 13:16–~15:15 UTC Sep 8
5. Review on-chain approvals/transfers in that window for unexpected recipients/spenders
**How found:** Wiz telemetry analysis of cloud environments for presence of malicious code in bundles/assets; JFrog tracked expanding package scope.
**Exploitation:** Malicious code wraps `fetch`, `XMLHttpRequest`, `window.ethereum.request` and Solana signing methods; scans responses and tx payloads for ETH/BTC/SOL/TRX/LTC/BCH addresses and silently rewrites recipients, spender addresses and ERC-20 allowances to attacker wallets before the user signs, using look-alike substitutions to keep UI plausible.
**Escalation:** Reached ~10% of cloud environments within the 2-hour window via transitive dependency propagation; scope expanded to DuckDB ecosystem packages.
**Insight:** Popular utility packages (debug, chalk) are transitively bundled into frontend builds far more than their direct usage suggests — inventory lockfiles and built bundles, not just direct dependencies, and treat CDN/service-worker caches as persistence for injected client-side code.