JavaScript Debugging Utility Vulnerability in Debug by Qix

CVE-2025-59144

What is CVE-2025-59144?

The Debug package, a widely used JavaScript debugging utility, was compromised following a phishing attack that led to the publishing of a malicious version. Version 4.4.2 included a payload designed to redirect cryptocurrency transactions to an attacker's addresses when used in browser environments. npm promptly removed the infected package; however, users who encountered this version must take immediate action, including upgrading to version 4.4.3, clearing their node_modules directory, and rebuilding bundles to eliminate the risk. This incident underscores the importance of vigilance in package management and supply chain security.

References