September 8, 2025 at 4:31:52 PM UTC

	Since	posts	replies	likes	reposts and quotes	views
Bluesky	May 2023	1,039	8,236	23,127	2,380
Mastodon	Nov 2022	2,399	29,156	55,396	16,820
GitHub	Jul 2010	179	5,777 3,520	33,866	3,317
npm	Jul 2014	139	1,546			75,991,720
YouTube	Dec 2015	30		1,203		32,713
Letterboxd	Mar 2026	55
Blog	Nov 2025	20
Hacker News	Jan 2011	59	575	802
All	Jul 2010	4,807	37,967	114,394	22,517	76,024,433

Watch very closely to see how other affected tools in the JavaScript ecosystem handle this one 👀

Notice: one of Eleventy’s dependencies was compromised a few hours ago. `debug@4.4.2` was the compromised version affected (it is now unpublished from npm).

More context: socket.dev/blog/npm-aut...

— Build Awesome (11ty) (September 8, 2025 at 4:18:59 PM UTC)

23 replies

Zach Leatherman 6 min later

whoa, I just tested this an @astro.build installs are still actively compromised. someone needs to unpublish simple-swizzle@0.2.3 IMMEDIATELY
1. Zach Leatherman 7 min later
  
  cc @mk.gg!
  1. Matt Kane 27 min later
    
    Thanks!
2. Zach Leatherman 2 hr later
  
  The affected package has been removed from npm, over 5 hours after it was published. Whew, what a ride.
Zach Leatherman 1 hr later

radio silence from all of these accounts is kinda wild to see too:
1. Pelle Wessman 2 hr later
  
  Seems to be a crypto stealing campaign
  1. Pelle Wessman 2 hr later
    
    And there is more chatter in Slack and Discord right now when everyone is figuring things out
    1. Pelle Wessman 2 hr later
      
      I posted a little reminder in one channel about engaging some of the social media accounts behind some of the larger projects there
2. Wes 2 hr later
  
  Well I for one have been working internally on mitigations and missed lunch dealing with this. The last thing on my mind was an announcement via socials. This is a good reminder to post, and I will go do that now, but also lets not judge OSS maintainers while we are at it.
  1. Wes 2 hr later
    
    bsky.app/profile/expr...
    1. Zach Leatherman 2 hr later
      
      nice to see an update from astro too bsky.app/profile/mk.g...
3. Matt Kane 2 hr later
  
  We were busy putting out a release
  1. Wes 2 hr later
    
    bsky.app/profile/notw...
    
    As much as I am pro responsibility for OSS maintainers, I want to point out that there are more important things you can do than make a social post. Let's level up our empathy and start with giving that grace to fellow maintainers.
  2. Zach Leatherman 3 hr later
    
    oh, huh — are you the only one doing release management over there? sorry for roping you in after-hours
    1. Matt Kane 3 hr later
      
      I was genuinely grateful for the heads-up, and that's why I took the lead in doing the mitigation. Luckily others were around to handle the release while I took my daughter to gymnastics. We did the socials after the release. Not everything needs to be an opportunity to dunk on other maintainers
      1. Zach Leatherman 3 hr later
        
        Huh… sorry. I don’t want the post to come across as a dunk — I was only reacting to the situation in real time and was surprised the ecosystem at large wasn’t escalating faster
        
        Matt Kane 3 hr later
        
        OK, cool. Most of the relevant core maintainers are in Europe, so it was out of hours for us all. We don't have pagerduty: we just have Discord!
        
        Zach Leatherman 3 hr later
        
        For sure — the only reason I was early to the thread was time-zone luck!
4. Simon H 3 hr later
  
  What a weird thing to say while people are actively analyzing the impact of the situation, some after-hours
  1. Zach Leatherman 3 hr later
    
    Really happy to see more accounts posting about it now! This situation felt like it needed urgent escalation to more people!
    1. Simon H 3 hr later
      
      In our case it would have been needless panic: bsky.app/profile/svel...
      1. Zach Leatherman 3 hr later
        
        Good thread!
5. tent10.bsky.social 8 hr later
  
  Dang what a way to be lol why did you do this in the most toxic way