One phished login, 18 poisoned packages, 74 minutes of silence: so I built a graph that asks who can poison your app
This story is from 2026-10-17. It is preserved in the archive; the latest stories are on the live feed.
On September 8, 2025 , someone phished the npm login of one well-known maintainer, @qix . Within minutes, poisoned versions of 18 packages went out: debug , chalk , ansi-styles , strip-ansi … packages with around 2 billion downloads a week between them, sitting deep inside millions of apps. The fir…
Read the full story at DEV Community — AI ↗
Timeline · 1 report
- 2026-10-17 12:15 · DEV Community — AI
One phished login, 18 poisoned packages, 74 minutes of silence: so I built a graph that asks who can poison your app