MetaMask SDK indirectly exposed via malicious debug@4.4.2 dependency

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS

not scored

EPSS

No dated EPSS signal available.

As published by the source; long descriptions are shortened.

Who is affected? This advisory only applies to developers who use MetaMask SDK in the browser and who, on Sept 8th 2025 between 13:00–15:30 UTC, performed one of the following actions and then deployed their application: - Installed MetaMask SDK into a project with a lockfile for the first time - Installed MetaMask SDK in a project without a lockfile - Updated a lockfile to pull in debug@4.4.2 (e.g., via npm update or yarn upgrade) What happened? On Sept 8th, 2025 (13:00–15:30 UTC), a malicious version of the debug package (v4.4.2) was published to npm. The injected code attempts to interfere with dApp-to-wallet communication when executed in a browser context. While MetaMask SDK itself was not directly impacted, projects installing the SDK during this window may have inadvertently pulled in the malicious version of debug. Mitigation - If your application was rebuilt and redeployed after Sept 8th, 2025, 15:30 UTC, the malicious version of debug should no longer be present. Please…

Published by the source

15 Sep 2025, 13:55 UTC

Last modified by the source

15 Sep 2025, 13:55 UTC

Source last checked

26 Oct 2026, 12:37 UTC

1. Revision 2 · amended · 26 Oct 2026

   Amended from ghsa record GHSA-qj3p-xc97-xw74

2. Revision 1 · created · 24 Oct 2026

   Published from osv record GHSA-qj3p-xc97-xw74

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: GHSA-qj3p-xc97-xw74

Advisory: MetaMask SDK indirectly exposed via malicious debug@4.4.2 dependency
IDs: GHSA-qj3p-xc97-xw74
Record: https://patchnext.com/advisories/ghsa-qj3p-xc97-xw74 (revision 2, source checked 26 Oct 2026, 12:37 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: Unrated
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor fix available; fixed versions by package: @metamask/sdk-communication-layer 0.33.1; @metamask/sdk 0.33.1; @metamask/sdk-react 0.33.1. A vendor fix does not mean a deployment is fixed.

## Affected components
- npm @metamask/sdk-communication-layer: affected >= 0.16.0, <= 0.33.0; fixed in 0.33.1
- npm @metamask/sdk: affected >= 0.16.0, <= 0.33.0; fixed in 0.33.1
- npm @metamask/sdk-react: affected >= 0.16.0, <= 0.33.0; fixed in 0.33.1

## Suggested inspection (read-only)
- `npm ls @metamask/sdk-communication-layer --all`: lists every installed copy and version, including transitive ones. Run in the project root after `npm ci`.
- `npm ls @metamask/sdk --all`: lists every installed copy and version, including transitive ones. Run in the project root after `npm ci`.
- `npm ls @metamask/sdk-react --all`: lists every installed copy and version, including transitive ones. Run in the project root after `npm ci`.

## Supported action
Upgrade each affected component to a fixed version on its release line. For a transitive dependency, upgrade the parent package or add an override or constraint, then regenerate the lockfile. Redeploy every environment that ran an affected version.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on @metamask/sdk-communication-layer, @metamask/sdk, @metamask/sdk-react.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://osv.dev/vulnerability/GHSA-qj3p-xc97-xw74 (OSV record GHSA-qj3p-xc97-xw74 lists affected ranges: npm @metamask/sdk >=0.16.0 =0.16.0 =0.16.0 <0.33.1 (fixed))
- Verified: https://github.com/advisories/GHSA-qj3p-xc97-xw74 (GitHub-reviewed advisory GHSA-qj3p-xc97-xw74 lists affected ranges: npm @metamask/sdk >=0.16.0 =0.16.0 =0.16.0 <=0.33.0)

Commands are suggestions: review each one before running it.