Uploaded September 2025 | Updated September 2026, 3 hours ago

---

Did a phishing email really lead to the largest supply chain attack in npm history? Not really, but it's a little complicated!

Links referenced in video:
https://semgrep.dev/blog/2025/chalk-debug-and-color-on-npm-compromised-in-new-supply-chain-attack/
https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised
news.ycombinator.com/item?id=45169657
github.com/Qix-
https://bsky.app/profile/bad-at-computer.bsky.social/post/3lydsjjzuds2t
gist.github.com/Qix-/c1f0d4f0d359dffaeec48dbfa1d40ee9
github.com/debug-js/debug/issues/1005#issuecomment-3266868187
web.archive.org/web/20250908162250/https://cdn.jsdelivr.net/npm/simple-swizzle@0.2.3/index.js
github.com/chalk/chalk/issues/656#issuecomment-3266900029
etherscan.io/address/0xFc4a4858bafef54D1b1d7697bfb5c52F4c166976#tokentxns
https://infosec.exchange/@GossiTheDog@cyberplace.social/115169882087261187

X: https://x.com/0xTib3rius
Bluesky: https://bsky.app/profile/tib3rius.bsky.social
Twitch: twitch.tv/0xTib3rius
InfoSec Exchange: https://infosec.exchange/@tib3rius
LinkedIn: linkedin.com/in/tib3rius
Courses: courses.tib3rius.com
Udemy: udemy.com/user/tib3rius
Discord: discord.com/invite/4qrvKMh
TikTok: tiktok.com/@0xtib3rius
Instagram: instagram.com/0xtib3rius
Threads: threads.net/@0xtib3rius
Facebook: facebook.com/0xTib3rius