[email protected] contains malware after npm account takeover

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2025-59144 · Microsoft / collected KEV context

EUVD-2025-29226

GHSA-4x49-vf9v-38px

GHSA-8mgj-vmr8-frr6

MAL-2025-46974

cve-program · CVE-2025-59144

• https://github.com/debug-js/debug/security/advisories/GHSA-4x49-vf9v-38px
• https://github.com/debug-js/debug/issues/1005
• https://socket.dev/blog/npm-author-qix-compromised-in-major-supply-chain-attack
• https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised
• https://www.ox.security/blog/npm-packages-compromised

euvd · EUVD-2025-29226

• https://github.com/debug-js/debug/security/advisories/GHSA-4x49-vf9v-38px
• https://github.com/debug-js/debug/issues/1005
• https://socket.dev/blog/npm-author-qix-compromised-in-major-supply-chain-attack
• https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised
• https://www.ox.security/blog/npm-packages-compromised

nvd · CVE-2025-59144

• https://github.com/debug-js/debug/issues/1005
• https://github.com/debug-js/debug/security/advisories/GHSA-4x49-vf9v-38px
• https://socket.dev/blog/npm-author-qix-compromised-in-major-supply-chain-attack
• https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised
• https://www.ox.security/blog/npm-packages-compromised
• http://www.openwall.com/lists/oss-security/2026/09/23/8

osv · GHSA-4x49-vf9v-38px

• https://github.com/debug-js/debug/security/advisories/GHSA-4x49-vf9v-38px
• https://nvd.nist.gov/vuln/detail/CVE-2025-59144
• https://github.com/debug-js/debug/issues/1005
• https://github.com/debug-js/debug
• https://socket.dev/blog/npm-author-qix-compromised-in-major-supply-chain-attack
• https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised
• https://www.ox.security/blog/npm-packages-compromised

osv · MAL-2025-46974

• https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised
• https://www.bleepingcomputer.com/news/security/hackers-hijack-npm-packages-with-2-billion-weekly-downloads-in-supply-chain-attack/
• https://github.com/github/advisory-database/issues/6099
• https://github.com/advisories/GHSA-8mgj-vmr8-frr6
• https://github.com/debug-js/debug/security/advisories/GHSA-4x49-vf9v-38px

No related operational record is retained in the current change model.