Post

Notice: one of Eleventy’s dependencies was compromised a few hours ago. `debug@4.4.2` was the compromised version affected (it is now unpublished from npm). More context: socket.dev/blog/npm-aut...

socket.devnpm Author Qix Compromised via Phishing Email in Major Suppl...npm author Qix’s account was compromised, with malicious versions of popular packages like chalk-template, color-convert, and strip-ansi published.

8/9/25, 4:18 pm18 reposts49 likes

Build Awesome (11ty)

@11ty.dev

8 Sept 2025

To check to see if your project was affected, check your package-lock.json file to see what version of `debug` you have installed.

Build Awesome (11ty)

@11ty.dev

8 Sept 2025

Some more information about the payload here: www.aikido.dev/blog/npm-deb...

aikido.devnpm debug and chalk packages compromisedThe popular packages debug and chalk on npm have been compromised with malicious code