Waiting seven days before installing new package releases would have avoided the chalk and debug malware

In September 2025, phishing compromised a maintainer account for popular npm packages including chalk and debug, and new versions were published containing code to steal cryptocurrency from browsers. The community detected the malicious releases quickly and they were removed within hours, so only teams that installed during that window were affected. Most bad releases are ordinary mistakes such as broken builds or missing files, and they tend to follow a similar pattern of rapid publication, quick issue reports, and then deprecation or a fix. A common safeguard is to delay installing any release until it is about a week old, which is built into tools like Renovate and available as a cooldown setting in Dependabot. Security patches warrant a separate, faster process, since delaying them carries its own risk.