UnratednpmAmendedPublished
MetaMask SDK indirectly exposed via malicious debug@4.4.2 dependency
GHSA-qj3p-xc97-xw74
- Affected
- npm @metamask/sdk >= 0.16.0, <= 0.33.0
- Fixed in
- 0.33.1· Vendor fix available
- Issue
- Who is affected? This advisory only applies to developers who use MetaMask SDK in the browser and who, on Sept 8th 2025 between 13:00–15:30 UTC, performed one of the following actions and then deployed their application: - Installed MetaMask SDK into a project with a lockfile for the first time - Installed MetaMask SDK in a project without a lockfile - Updated a lockfile to pull in debug@4.4.2 (e.g., via npm update or yarn upgrade) What happened? On Sept 8th, 2025 (13:00–15:30 UTC), a malicious version of the debug package (v4.4.2) was published to npm. The injected code attempts to interfere with dApp-to-wallet communication when executed in a browser context. While MetaMask SDK itself was not directly impacted, projects installing the SDK during this window may have inadvertently pulled in the malicious version of debug. Mitigation - If your application was rebuilt and redeployed after Sept 8th, 2025, 15:30 UTC, the malicious version of debug should no longer be present. Please…
Recommended action: Upgrade to 0.33.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.