Some of the most widely used open source packages in the world were compromised and used to deliver a supply chain attack to hundreds of millions of users earlier this week.

If your system automatically updates to the latest versions, you may already be infected, and like many teams you may not know it yet. But here's the bigger question: what’s stopping it from happening again next week?

Seal Security helps teams stay secure without constantly chasing upgrades. We make it easy to identify, isolate, and patch vulnerable dependencies, without risky upgrades or disrupting your development workflow.

What Happened?

Earlier this week, 18 popular NPM packages have been hijacked and injected with malware after threat actors obtained multiple maintainer's login credentials via a phishing campaign.

These packages have over 2.6 billion combined weekly downloads, making this possibly the largest supply chain attack in history.

If your team is using any of the following packages, you should downgrade to safe versions immediately and begin monitoring for indicators of compromise:

• ansi-styles (371.41m downloads per week)
• debug (357.6m downloads per week)
• chalk (299.99m downloads per week)
• supports-color (287.1m downloads per week)
• strip-ansi (261.17m downloads per week)
• ansi-regex (243.64m downloads per week)
• wrap-ansi (197.99m downloads per week)
• color-convert (193.5m downloads per week)
• color-name (191.71m downloads per week)
• is-arrayish (73.8m downloads per week)
• slice-ansi (59.8m downloads per week)
• error-ex (47.17m downloads per week)
• color-string (27.48m downloads per week)
• simple-swizzle (26.26m downloads per week)
• supports-hyperlinks (19.2m downloads per week)
• has-ansi (12.1m downloads per week)
• chalk-template (3.9m downloads per week)
• backslash (0.26m downloads per week)

These are deeply embedded transitive dependencies in nearly every modern JavaScript stack: from build tools to CLI interfaces to production apps.

How the Malware Works

The malware works by injecting itself into the browser and monitoring for sensitive data related to cryptocurrency, then taking control almost like a digital pickpocket.

After detecting a transaction, it reroutes the transaction to an address owned by the attackers, stealing the payment while showing the user the original destination in the user interface, helping it remain undetected.

The malicious code is typically injected into widely used utility packages (like chalk, debug, etc.) that are deeply embedded in dependency trees. Its obfuscation and execution path make it difficult for scanners to catch during normal dev/test cycles.

Some variants attempt to exfiltrate environment variables, credentials, or secrets during CI/CD builds or local development - especially if the system runs automated scripts that import these packages.

Why This Keeps Happening

This attack wasn’t the first and it won’t be the last. 

• Transitive dependencies hide risk: You may never explicitly install chalk, but it likely came with React, Next.js, or your test runner. “Micro-packages” on NPM also make it easy to disguise these attacks, as they increase the parts of the dependency chain.
  
• Auto-updates are risky by default: Most teams pull in the “latest” package versions automatically - which in this case meant malware.
• Maintainers aren’t immune to phishing: Even top contributors can fall victim, as we saw here and in the xz backdoor incident.

What to Do Next

1. Given the popularity of NPM and these packages, you should use Software Composition Analysis (SCA) tools to search for any impacted versions 
2. Roll back to known-good versions and pin dependencies.

• The following versions of the libraries were impacted by this attack:
  
  • backslash 0.2.1
  • chalk-template 1.1.1
  • supports-hyperlinks 4.1.1
  • has-ansi 6.0.1
  • simple-swizzle 0.2.3
  • color-string 2.1.1
  • error-ex 1.3.3
  • color-name 2.0.1
  • is-arrayish 0.3.3
  • slice-ansi 7.1.1
  • color-convert 3.1.1
  • wrap-ansi 9.0.1
  • ansi-regex 6.2.1
  • supports-color 10.2.1
  • strip-ansi 7.1.1
  • chalk 5.6.1
  • debug 4.4.2
  • ansi-styles 6.2.2

3. Pin to safe versions or install Sealed packages
4. Reinstall clean

As demonstrated in this incident, the latest version of a library may not always be safe for use. New code that isn't vetted by your team can introduce vulnerabilities, and an automatic upgrade could open the front door to supply chain hackers like we see in this attack.

It is possible that more impacted packages or breached maintainer accounts will be found in the future, as the phishing email that many are labeling responsible for this attack was sent to an unknown number of maintainers. As of 7:00 PM ET on September 8th, 2 maintainer accounts have been associated with impacted packages.

The nature of this breach also serves as a reminder for teams to ensure they remain vigilant against credential theft attacks. Developers are popular targets for cybercriminals, and ensuring that not only your organization has good security hygiene but also those you depend on can help you stay safe.

A Safe Fix, No Upgrades Required

Seal Security provides production-ready patches for vulnerable open-source packages, including deep transitive dependencies like chalk, ansi-styles, or strip-ansi.

• Patch-in-place with zero functional changes
• Avoid compromised versions entirely, even in transitive dependencies
• Stay compliant and secure without disrupting your roadmap or engineering velocity

We support your vulnerability management efforts with a 72-hour SLA on critical and high CVEs, ensuring rapid remediation and measurable risk reduction. 

Additionally, our libraries are unimpacted by supply chain attacks like this, as our approach is focused on patching previous versions of libraries or the transitive dependencies they use. We give you just the security fixes you need, and nothing else so you can be confident.

See it in action and book a demo today.

‍