Dependency health Workspace

chalknpm

Documented supply-chain history

This package has dated incident reports relevant to its trust history. Check the affected releases and the response before drawing conclusions about its current version.

Read the incident coverage →

Supply-chain news and reputation

Dated reporting about this package. These events are separate from its current maintenance score.

· npm

Chalk, debug and other npm packages carried wallet-targeting code ↗

Aikido reported compromised releases across a widely used group of npm packages. The injected browser code attempted to redirect cryptocurrency transactions to attacker-controlled destinations.

Affected versions: Affected releases differ by package; see the original report.

Packages: chalk · debug · ansi-styles · supports-color · strip-ansi · ansi-regex · color-convert · color-name · wrap-ansi · slice-ansi · is-arrayish · error-ex · color-string · simple-swizzle · has-ansi · supports-hyperlinks · chalk-template · backslash

Source: Aikido Security

All supply-chain news →
What the project says about itself
  • Build provenance — the latest release carries no provenance attestation. Source: the registry.
  • Supported runtime — node >=22. Source: the registry.
  • Publishers on the registry — 1. Source: the registry.
  • Funding — github.com/chalk/chalk?sponsor=1. Source: the registry.
  • OpenSSF Scorecard — 4.6 / 10 on 2026-08-17. Source: OpenSSF, via deps.dev. A third party's view of security practice, not part of the health score.

Third-party facts checked today; registry facts on every crawl.

State history 1
WhenChange
2026-09-05 first verdict: active
Supply-chain history 1

  1. account hijacked 2025-09

    Its maintainer was phished and versions with a crypto-clipboard payload were live for a few hours, in the same incident across several packages from one account.

    Malicious versions were removed within hours; the exposure window was short.

    Source: npm phishing incident reporting, 8 September 2025. History, not a warning about today — the verdict above is about maintenance now.

Badge

maintenance: active

Drop this in your README. It re-renders itself as the verdict changes.

[![maintenance](https://isitdeadyet.dev/badge/npm/chalk.svg)](https://isitdeadyet.dev/npm/chalk)

Watch it

Get told when chalk changes state, changes licence, or is deprecated — instead of finding out during an incident.

Free for up to 25 packages. Signing in is a link sent to your email — there is no password to choose.