*MAL-2025-46974 — Malicious code in debug (npm)*
3 of 13 watched services resolved a compromised version; 3 did so while it was still installable; none is reachable from first-party code.

*Headline* · services exposed `3` · act now `0` · resolved while live `3` · maintainer packages `32` · look-alike names `2` · unscanned `0`

*Q1 exposed*
• `ChrisTregaskis/ai-research-automation` — L0 present only via eslint@8.57.1
• `GoMake-ltd/n8n-node-gomake` — L0 present only via eslint@8.57.1
• `LVQT-ss/cakestory-api` — L0 present only via agent-base@6.0.2
*Q2 versions*
• `debug@4.4.2` published 2025-09-08 13:12:39Z, live until 2025-09-08 14:26:51Z (upper bound), removed
*Q3 resolved while live* · 2 in window, 6 pins removed (live_to is an upper bound)
• `LVQT-ss/cakestory-api` 458e59e at 2025-09-08 14:05:12Z — in window · pins removed
• `GoMake-ltd/n8n-node-gomake` c361ccf at 2025-09-08 14:09:18Z — in window · pins removed
• `ChrisTregaskis/ai-research-automation` 80fc6d0 at 2025-09-08 15:04:59Z — pins removed
• `ChrisTregaskis/ai-research-automation` 5b74cd6 at 2025-09-08 16:55:24Z — pins removed
• `ChrisTregaskis/ai-research-automation` 6681e87 at 2025-09-09 15:54:36Z — pins removed
• … +1 more
*Q4 maintainers* · qix, tootallnate — 32 co-maintained packages
• `color-convert` 287659317 weekly · 13 services
• `util-deprecate` 123634143 weekly · 12 services
• `agent-base` 218048895 weekly · 10 services
• `https-proxy-agent` 164323294 weekly · 10 services
• `is-arrayish` 103734318 weekly · 10 services
• … +27 more
*Q5 look-alikes* · 2 names
• scope confusion: `@prisma/debug (d1)`, `@types/debug (d1)`
*Q6 blast radius*
• act now: none
• present only: ChrisTregaskis/ai-research-automation, GoMake-ltd/n8n-node-gomake, LVQT-ss/cakestory-api
• unscanned: none

generated 2026-08-16 14:28:33Z · 6 lockfile snapshots · 16.45 s
https://reachable-lac.vercel.app/incident/MAL-2025-46974