Skip to content

Conversation

@jiexi
Copy link
Contributor

@jiexi jiexi commented Sep 9, 2025

Explanation

The author of the debug package had their account compromised and the attacker published code in this package on version 4.4.2. This PR updates pins this dependency to 4.3.4 exactly, without accepting minor version bumps.

While the MetaMask SDK wasn't directly impacted by this supply chain attack, users of the SDK may have downloaded affected versions of these packages.

Developers should audit their dependencies for malicious packages, and update any packages using npm upgrade/npm override, or yarn up/yarn resolutions

References

Fixes: debug-js/debug#1005 (comment)
See: https://socket.dev/blog/npm-author-qix-compromised-in-major-supply-chain-attack

Checklist

  • I've updated the test suite for new or updated code as appropriate
  • I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate
  • I've highlighted breaking changes using the "BREAKING" category above as appropriate

@jiexi jiexi requested a review from a team as a code owner September 9, 2025 16:14
@codecov
Copy link

codecov bot commented Sep 9, 2025

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 74.93%. Comparing base (5715f47) to head (62daa45).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files
@@           Coverage Diff           @@
##             main    #1342   +/-   ##
=======================================
  Coverage   74.93%   74.93%           
=======================================
  Files         184      184           
  Lines        4513     4513           
  Branches     1105     1105           
=======================================
  Hits         3382     3382           
  Misses       1131     1131           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@sonarqubecloud
Copy link

sonarqubecloud bot commented Sep 9, 2025

@dylanbutler1 dylanbutler1 merged commit baa185c into main Sep 9, 2025
42 checks passed
@dylanbutler1 dylanbutler1 deleted the jl/fix-debug-npm-vuln-version branch September 9, 2025 19:15
This was referenced Sep 9, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

(RESOLVED) Version 4.4.2 published to npm is compromised

4 participants