Post

🚨 Breaking: npm author Qix compromised. Malicious package versions published in projects that typically see hundreds of millions of downloads each week. Details: socket.dev/blog/npm-aut...

socket.devnpm Author Qix Compromised in Major Supply Chain Attack - So...npm author Qix’s account was compromised, with malicious versions of popular packages like chalk-template, color-convert, and strip-ansi published.

8/9/25, 3:23 pm25 reposts29 likes

Zach Leatherman

@zachleat.com

8 Sept 2025

y’all a compromised package simple-swizzle@0.2.3 looks like it’s still available?? www.npmjs.com/package/simp... cc @npmjs.bsky.social

Zach Leatherman

@zachleat.com

8 Sept 2025

cc @bad-at-computer.bsky.social

Arkadiy Kukarkin

@arkadiy.bsky.social

8 Sept 2025

I don't see any alerts under socket.dev/npm/package/..., 5.6.1 is listed as unpublished but without further details, is this the expected behavior?

socket.devchalk - npm Package Versions - SocketVersion: 5.6.1 was published by qix. Start using Socket to analyze chalk and its dependencies to secure your app from supply chain attacks.

Socket

@socket.dev

8 Sept 2025

This is the version with the malware: socket.dev/npm/package/...

socket.devchalk - npm Package Security Analysis - SocketVersion: 5.6.1 was published by qix. Start using Socket to analyze chalk and its dependencies to secure your app from supply chain attacks.

Arkadiy Kukarkin

@arkadiy.bsky.social

9 Sept 2025

is there an audit history for when the release was marked as malware in your system? I opened that release page before my original reply and only saw the "release was removed" box not the malware/obfuscation messages