From Dev.to
chalk and debug shipped malware for a few hours. Waiting 7 days would have skipped it.
In September 2025, a maintainer of several very popular npm packages, including chalk and debug, had their account phished. New versions were published with code that tried to steal cryptocurrency fro...