npm debug and chalk packages compromised
A post on aikido.dev is cited by 19 distinct blogs to date (corpus.blog, measured 12 October 2026).
A record is what was published and who pointed at it. The text of the post is not shown here: read it at the source, or at its Wayback capture.
19blogs citing
| Period | Blogs | Links |
|---|---|---|
| All time | 19 | 21 |
| Last 90 days | 1 | 1 |
| Last 30 days | 1 | 1 |
| Last 7 days | 1 | 1 |
| First cited | 8 Sept 2025 |
|---|---|
| Latest citation | 9 Oct 2026 |
| Words blogs link it with | 5 |
| Linked with its own title | 3 of 19 blogs |
| External links | 4 |
| Length | 11,258 |
0 this week (still settling) · peak 9
Show as table
| Week of | Value |
|---|---|
| 8 Sept 2025 | 9 |
| 15 Sept 2025 | 1 |
| 22 Sept 2025 | 2 |
| 29 Sept 2025 | 3 |
| 6 Oct 2025 | 0 |
| 13 Oct 2025 | 1 |
| 20 Oct 2025 | 0 |
| 27 Oct 2025 | 0 |
| 3 Nov 2025 | 0 |
| 10 Nov 2025 | 0 |
| 17 Nov 2025 | 0 |
| 24 Nov 2025 | 1 |
| 1 Dec 2025 | 0 |
| 8 Dec 2025 | 0 |
| 15 Dec 2025 | 0 |
| 22 Dec 2025 | 0 |
| 29 Dec 2025 | 0 |
| 5 Jan 2026 | 0 |
| 12 Jan 2026 | 0 |
| 19 Jan 2026 | 0 |
| 26 Jan 2026 | 0 |
| 2 Feb 2026 | 0 |
| 9 Feb 2026 | 0 |
| 16 Feb 2026 | 0 |
| 23 Feb 2026 | 0 |
| 2 Mar 2026 | 0 |
| 9 Mar 2026 | 0 |
| 16 Mar 2026 | 0 |
| 23 Mar 2026 | 0 |
| 30 Mar 2026 | 0 |
| 6 Apr 2026 | 0 |
| 13 Apr 2026 | 0 |
| 20 Apr 2026 | 0 |
| 27 Apr 2026 | 0 |
| 4 May 2026 | 0 |
| 11 May 2026 | 0 |
| 18 May 2026 | 0 |
| 25 May 2026 | 1 |
| 1 Jun 2026 | 0 |
| 8 Jun 2026 | 0 |
| 15 Jun 2026 | 0 |
| 22 Jun 2026 | 0 |
| 29 Jun 2026 | 0 |
| 6 Jul 2026 | 0 |
| 13 Jul 2026 | 0 |
| 20 Jul 2026 | 0 |
| 27 Jul 2026 | 0 |
| 3 Aug 2026 | 0 |
| 10 Aug 2026 | 0 |
| 17 Aug 2026 | 0 |
| 24 Aug 2026 | 0 |
| 31 Aug 2026 | 0 |
| 7 Sept 2026 | 0 |
| 14 Sept 2026 | 0 |
| 21 Sept 2026 | 0 |
| 28 Sept 2026 | 0 (still settling) |
| 5 Oct 2026 | 1 (still settling) |
| 12 Oct 2026 | 0 (still settling) |
Shape: spike. Half of its 19 citing blogs had cited it after 12 days; 5% first cited it more than a year on.
Each blog counts once, in the week of its first citation. A blog added to the index recently can bring old first citations in at once.
Who cited it
Cited by 19 blogs across 2 subjects: technology 11, design and making 1, unclassified 7.
- Technology11
- Design and making1
- Unclassified7
Words blogs link it with
The words blogs link this page with, by how many different blogs use them.
- npm debug and chalk packages compromised3 blogs
- 18 popular javascript packages were maliciously updated1 blog
- according to security researchers at aikido1 blog
- aikido security: qix / core package analysis1 blog
- blog post1 blog
Cited by 19 blogs in 21 posts
One row per blog, the most recently citing first. Each shows the blog's newest citing post; open a row for the others.
linked as “published malicious versions of eighteen packages”
Read at michelebologna.net (opens in a new tab)linked as “chalk”
Read at tim.alby.fr (opens in a new tab)linked as “blog post”
Read at anchore.com (opens in a new tab)1 other post
linked as “npm debug and chalk packages compromised”
Read at anchore.com (opens in a new tab)linked as “npm debug and chalk packages compromised”
Read at adamsdesk.com (opens in a new tab)linked as “18 popular JavaScript packages were maliciously updated”
Read at digitalseams.com (opens in a new tab)linked as “September 8th, 2025, starting at 13:16 UTC”
Read at jpcouture.bearblog.dev (opens in a new tab)linked as “latest NPM credential hack”
Read at chainguard.dev (opens in a new tab)linked as “In early September”
Read at redcanary.com (opens in a new tab)linked as “one affecting the popular packages chalk and debug”
Read at vincent.bernat.ch (opens in a new tab)linked as “npm debug and chalk packages compromised”
Read at fuzzygrim.com (opens in a new tab)linked as “Aikido Security: Qix / core package analysis”
Read at vercel.com (opens in a new tab)1 other post
linked as “supply chain attack compromised 18 popular npm packages”
Read at vercel.com (opens in a new tab)linked as “news”
Read at gribnau.dev (opens in a new tab)linked as “npm Chalk/Debug packages issue”
Read at mayakaczorowski.com (opens in a new tab)linked as “Original post”
Read at sibellavia.lol (opens in a new tab)linked as “several depedencies that are used daily by thousands of developers”
Read at tane.dev (opens in a new tab)linked as “compromise of widely used npm packages”
Read at sonatype.com (opens in a new tab)linked as “one of the biggest package ecosystems had very popular packages get compromised”
Read at xeiaso.net (opens in a new tab)linked as “According to security researchers at Aikido”
Read at nowsecure.com (opens in a new tab)Links from this post
Elsewhere on aikido.dev (3)
Something wrong here? Report a problem