Understand the September 2025 debug package compromise

The September 2025 npm incident included a malicious release of debug after its publishing account was taken over. The maintainer's advisory identifies 4.4.2 as affected and 4.4.3 as the patched version ^[1].

What the payload targeted

According to the advisory, the added code attempted to redirect cryptocurrency transactions inside browsers. It distinguishes that exposure from local tools, command-line applications and server environments, which the described payload did not affect ^[1].

A package's download count is not a count of successful compromises. Our original caption used a broad download figure; the practical question is whether the affected version reached a browser bundle that your site served.

Why removing the release was not enough

npm removed the malicious package on September 8. Existing browser bundles and private registry caches could still contain it. The advisory recommends upgrading, clearing the affected installations and caches, then rebuilding browser bundles ^[1].

Check the dependency version recorded in the build that actually shipped. A clean current lockfile alone does not establish which code an older deployment served. Use the maintainer's advisory when investigating that historical build, and preserve the relevant deployment records.