2026 Chalk (npm) — Supply chain attack, 20+ packages compromised
Data compromised
Crypto wallets; transaction redirection
Technical writeup
Maintainer account compromised; malicious code injected into chalk and 20+ packages (debug, strip-ansi, color-convert). Code designed to steal crypto wallets and redirect blockchain transactions. Billions of weekly downloads. One of largest JavaScript ecosystem attacks.
Root cause
Supply chain; maintainer account compromise