Post

🚨 Breaking: npm author Qix compromised. Malicious package versions published in projects that typically see hundreds of millions of downloads each week. Details: socket.dev/blog/npm-aut...

socket.devnpm Author Qix Compromised in Major Supply Chain Attack - So...npm author Qix’s account was compromised, with malicious versions of popular packages like chalk-template, color-convert, and strip-ansi published.

Arkadiy Kukarkin

@arkadiy.bsky.social

8 Sept 2025

I don't see any alerts under socket.dev/npm/package/..., 5.6.1 is listed as unpublished but without further details, is this the expected behavior?

socket.devchalk - npm Package Versions - SocketVersion: 5.6.1 was published by qix. Start using Socket to analyze chalk and its dependencies to secure your app from supply chain attacks.

Socket

@socket.dev

This is the version with the malware: socket.dev/npm/package/...

socket.devchalk - npm Package Security Analysis - SocketVersion: 5.6.1 was published by qix. Start using Socket to analyze chalk and its dependencies to secure your app from supply chain attacks.

8/9/25, 8:15 pm0 reposts0 likes

Arkadiy Kukarkin

@arkadiy.bsky.social

9 Sept 2025

is there an audit history for when the release was marked as malware in your system? I opened that release page before my original reply and only saw the "release was removed" box not the malware/obfuscation messages