Security Alert: Massive Supply Chain Attack on npm ⚠️

On September 8, 2025, a severe supply chain attack was identified within the npm ecosystem, where several widely-used JavaScript packages were injected with malicious code. Attackers likely used compromised maintainer accounts to upload manipulated versions. These versions contain code designed to exfiltrate sensitive data, such as crypto wallet addresses and credentials.

It is critical that developers immediately audit their projects and replace all affected versions to mitigate this threat.

Affected Packages and Versions ⚠️

As of September 9, 2025, 00:00, the following packages have been identified as compromised:

Package NameAffected Version

• backslash 0.2.1
• chalk-template 1.1.1
• supports-hyperlinks 4.1.1
• has-ansi 6.0.1
• simple-swizzle 0.2.3
• color-string 2.1.1
• error-ex 1.3.3
• color-name 2.0.1
• is-arrayish 0.3.3
• slice-ansi 7.1.1
• color-convert 3.1.1
• wrap-ansi 9.0.1
• ansi-regex 6.2.1
• supports-color 10.2.1
• strip-ansi 7.1.1
• chalk 5.6.1
• debug 4.4.2
• ansi-styles 6.2.2

How to Scan Your Projects and Systems 🧐

To scan your javascript files for these malicious modules, you can use the Nuclei template I created. The template is available on my GitHub account: https://github.com/sl0th0x87/nuclei-sl0th0x87.

Scanning Process

Execute the following command to find subdomains, crawl for JavaScript files, and then scan them using the Nuclei template:

subfinder -d example.com -recursive -all | sort -u | httpx | katana -jc -silent | grep '.*\.js$' | tee all-javascript.lst
nuclei -l all-javascript.lst -t javascript-supply-chain-scan.yaml

• subfinder: Recursively discovers all subdomains for the specified domain.
• httpx: Validates the discovered subdomains to ensure they are reachable via HTTP/S.
• katana: Crawls the validated URLs and extracts JavaScript files.
• grep '.*\.js$': Filters the output to get only URLs ending with .js.
• tee all-javascript.lst: Saves the filtered URLs to the all-javascript.lst file.
• nuclei: Scans the URLs listed in all-javascript.lst with the provided template.

What is a Supply Chain Attack? ⛓️‍💥

A supply chain attack infiltrates the software delivery process by compromising one of its dependencies, such as a library or a package. By doing so, attackers can reach a large number of victims with minimal effort, as these dependencies are used in thousands of projects. In this case, the npm ecosystem was the attack vector.

Update: This blog post will be updated as new information becomes available regarding the affected packages or any further developments.