CWE-506
Embedded Malicious Code
The product contains code that appears to be malicious in nature.
CVE-2025-59038 (GCVE-0-2025-59038)
Vulnerability from cvelistv5 – Published: 2025-09-09 22:17 – Updated: 2025-09-10 18:02
VLAI
Title
Prebid.js NPM package briefly compromised
Summary
Prebid.js is a free and open source library for publishers to quickly implement header bidding. NPM users of prebid 10.9.2 may have been briefly compromised by a malware campaign. The malicious code attempts to redirect crypto transactions on the site to the attackers' wallet. Version 10.10.0 fixes the issue. As a workaround, it is also possible to downgrade to 10.9.1.
Severity
CWE
- CWE-506 - Embedded Malicious Code
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/prebid/Prebid.js/security/advi… | x_refsource_CONFIRM |
| https://www.sonatype.com/blog/npm-chalk-and-debug… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-59038",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-10T18:01:46.508749Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-09-10T18:02:00.169Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Prebid.js",
"vendor": "prebid",
"versions": [
{
"status": "affected",
"version": "= 10.9.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Prebid.js is a free and open source library for publishers to quickly implement header bidding. NPM users of prebid 10.9.2 may have been briefly compromised by a malware campaign. The malicious code attempts to redirect crypto transactions on the site to the attackers\u0027 wallet. Version 10.10.0 fixes the issue. As a workaround, it is also possible to downgrade to 10.9.1."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-506",
"description": "CWE-506: Embedded Malicious Code",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-09T22:17:08.493Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/prebid/Prebid.js/security/advisories/GHSA-jwq7-6j4r-2f92",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/prebid/Prebid.js/security/advisories/GHSA-jwq7-6j4r-2f92"
},
{
"name": "https://www.sonatype.com/blog/npm-chalk-and-debug-packages-hit-in-software-supply-chain-attack",
"tags": [
"x_refsource_MISC"
],
"url": "https://www.sonatype.com/blog/npm-chalk-and-debug-packages-hit-in-software-supply-chain-attack"
}
],
"source": {
"advisory": "GHSA-jwq7-6j4r-2f92",
"discovery": "UNKNOWN"
},
"title": "Prebid.js NPM package briefly compromised"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-59038",
"datePublished": "2025-09-09T22:17:08.493Z",
"dateReserved": "2025-09-08T16:19:26.171Z",
"dateUpdated": "2025-09-10T18:02:00.169Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-59039 (GCVE-0-2025-59039)
Vulnerability from cvelistv5 – Published: 2025-09-09 22:23 – Updated: 2025-09-10 18:00
VLAI
Title
Prebid Universal Creative on npm briefly compromised
Summary
Prebid Universal Creative (PUC) is a JavaScript API to render multiple formats. Npm users of PUC 1.17.3 or PUC latest were briefly affected by crypto-related malware. This includes the extremely popular jsdelivr hosting of this file. The maintainers of PUC unpublished version 1.17.3. Users should see Prebid.js 9 release notes for suggestions on moving off the deprecated workflow of using the PUC or pointing to a dynamic version of it. PUC users pointing to latest should transition to 1.17.2 as soon as possible to avoid similar attacks in the future.
Severity
CWE
- CWE-506 - Embedded Malicious Code
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/prebid/prebid-universal-creati… | x_refsource_CONFIRM |
| https://www.sonatype.com/blog/npm-chalk-and-debug… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| prebid | prebid-universal-creative |
Affected:
= 1.17.3
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-59039",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-10T17:47:53.143510Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-09-10T18:00:27.573Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "prebid-universal-creative",
"vendor": "prebid",
"versions": [
{
"status": "affected",
"version": "= 1.17.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Prebid Universal Creative (PUC) is a JavaScript API to render multiple formats. Npm users of PUC 1.17.3 or PUC latest were briefly affected by crypto-related malware. This includes the extremely popular jsdelivr hosting of this file. The maintainers of PUC unpublished version 1.17.3. Users should see Prebid.js 9 release notes for suggestions on moving off the deprecated workflow of using the PUC or pointing to a dynamic version of it. PUC users pointing to latest should transition to 1.17.2 as soon as possible to avoid similar attacks in the future."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-506",
"description": "CWE-506: Embedded Malicious Code",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-09T22:23:55.551Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/prebid/prebid-universal-creative/security/advisories/GHSA-m662-56rj-8fmm",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/prebid/prebid-universal-creative/security/advisories/GHSA-m662-56rj-8fmm"
},
{
"name": "https://www.sonatype.com/blog/npm-chalk-and-debug-packages-hit-in-software-supply-chain-attack",
"tags": [
"x_refsource_MISC"
],
"url": "https://www.sonatype.com/blog/npm-chalk-and-debug-packages-hit-in-software-supply-chain-attack"
}
],
"source": {
"advisory": "GHSA-m662-56rj-8fmm",
"discovery": "UNKNOWN"
},
"title": "Prebid Universal Creative on npm briefly compromised"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-59039",
"datePublished": "2025-09-09T22:23:55.551Z",
"dateReserved": "2025-09-08T16:19:26.171Z",
"dateUpdated": "2025-09-10T18:00:27.573Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-59140 (GCVE-0-2025-59140)
Vulnerability from cvelistv5 – Published: 2025-09-15 19:09 – Updated: 2025-09-16 13:48
VLAI
Title
backslash@0.2.1 contains malware after npm account takeover
Summary
backlash parses collected strings with escapes. On 8 September 2025, the npm publishing account for backslash was taken over after a phishing attack. Version 0.2.1 was published, functionally identical to the previous patch version, but with a malware payload added attempting to redirect cryptocurrency transactions to the attacker's own addresses from within browser environments. Local environments, server environments, command line applications, etc. are not affected. If the package was used in a browser context (e.g. a direct <script> inclusion, or via a bundling tool such as Babel, Rollup, Vite, Next.js, etc.) there is a chance the malware still exists and such bundles will need to be rebuilt. The malware seemingly only targets cryptocurrency transactions and wallets such as MetaMask. npm removed the offending package from the registry over the course of the day on 8 September, preventing further downloads from npm proper. On 13 September, the package owner published new patch versions to help cache-bust those using private registries who might still have the compromised version cached. Users should upgrade to the latest patch version, completely remove their node_modules directory, clean their package manager's global cache, and rebuild any browser bundles from scratch. Those operating private registries or registry mirrors should purge the offending versions from any caches. This issues is resolved in 0.2.2.
Severity
CWE
- CWE-506 - Embedded Malicious Code
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/Qix-/node-backslash/security/a… | x_refsource_CONFIRM |
| https://github.com/debug-js/debug/issues/1005 | x_refsource_MISC |
| https://socket.dev/blog/npm-author-qix-compromise… | x_refsource_MISC |
| https://www.aikido.dev/blog/npm-debug-and-chalk-p… | x_refsource_MISC |
| https://www.ox.security/blog/npm-packages-compromised | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Qix- | node-backslash |
Affected:
= 0.2.1
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-59140",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-16T13:48:40.390109Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-09-16T13:48:48.092Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "node-backslash",
"vendor": "Qix-",
"versions": [
{
"status": "affected",
"version": "= 0.2.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "backlash parses collected strings with escapes. On 8 September 2025, the npm publishing account for backslash was taken over after a phishing attack. Version 0.2.1 was published, functionally identical to the previous patch version, but with a malware payload added attempting to redirect cryptocurrency transactions to the attacker\u0027s own addresses from within browser environments. Local environments, server environments, command line applications, etc. are not affected. If the package was used in a browser context (e.g. a direct \u003cscript\u003e inclusion, or via a bundling tool such as Babel, Rollup, Vite, Next.js, etc.) there is a chance the malware still exists and such bundles will need to be rebuilt. The malware seemingly only targets cryptocurrency transactions and wallets such as MetaMask. npm removed the offending package from the registry over the course of the day on 8 September, preventing further downloads from npm proper. On 13 September, the package owner published new patch versions to help cache-bust those using private registries who might still have the compromised version cached. Users should upgrade to the latest patch version, completely remove their node_modules directory, clean their package manager\u0027s global cache, and rebuild any browser bundles from scratch. Those operating private registries or registry mirrors should purge the offending versions from any caches. This issues is resolved in 0.2.2."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:A/U:Red",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-506",
"description": "CWE-506: Embedded Malicious Code",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-15T19:09:53.500Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Qix-/node-backslash/security/advisories/GHSA-53mq-f4w3-f7qv",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Qix-/node-backslash/security/advisories/GHSA-53mq-f4w3-f7qv"
},
{
"name": "https://github.com/debug-js/debug/issues/1005",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/debug-js/debug/issues/1005"
},
{
"name": "https://socket.dev/blog/npm-author-qix-compromised-in-major-supply-chain-attack",
"tags": [
"x_refsource_MISC"
],
"url": "https://socket.dev/blog/npm-author-qix-compromised-in-major-supply-chain-attack"
},
{
"name": "https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised",
"tags": [
"x_refsource_MISC"
],
"url": "https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised"
},
{
"name": "https://www.ox.security/blog/npm-packages-compromised",
"tags": [
"x_refsource_MISC"
],
"url": "https://www.ox.security/blog/npm-packages-compromised"
}
],
"source": {
"advisory": "GHSA-53mq-f4w3-f7qv",
"discovery": "UNKNOWN"
},
"title": "backslash@0.2.1 contains malware after npm account takeover"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-59140",
"datePublished": "2025-09-15T19:09:53.500Z",
"dateReserved": "2025-09-09T15:23:16.326Z",
"dateUpdated": "2025-09-16T13:48:48.092Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-59141 (GCVE-0-2025-59141)
Vulnerability from cvelistv5 – Published: 2025-09-15 19:09 – Updated: 2025-09-16 13:47
VLAI
Title
simple-swizzle@0.2.3 contains malware after npm account takeover
Summary
simple-swizzle swizzles function arguments. On 8 September 2025, the npm publishing account for simple-swizzle was taken over after a phishing attack. Version 0.2.3 was published, functionally identical to the previous patch version, but with a malware payload added attempting to redirect cryptocurrency transactions to the attacker's own addresses from within browser environments. Local environments, server environments, command line applications, etc. are not affected. If the package was used in a browser context (e.g. a direct <script> inclusion, or via a bundling tool such as Babel, Rollup, Vite, Next.js, etc.) there is a chance the malware still exists and such bundles will need to be rebuilt. The malware seemingly only targets cryptocurrency transactions and wallets such as MetaMask. npm removed the offending package from the registry over the course of the day on 8 September, preventing further downloads from npm proper. On 13 September, the package owner published new patch versions to help cache-bust those using private registries who might still have the compromised version cached. Users should update to the latest patch version, completely remove their node_modules directory, clean their package manager's global cache, and rebuild any browser bundles from scratch. Those operating private registries or registry mirrors should purge the offending versions from any caches. This issue is resolved in 0.2.4.
Severity
CWE
- CWE-506 - Embedded Malicious Code
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/Qix-/node-simple-swizzle/secur… | x_refsource_CONFIRM |
| https://github.com/debug-js/debug/issues/1005 | x_refsource_MISC |
| https://socket.dev/blog/npm-author-qix-compromise… | x_refsource_MISC |
| https://www.aikido.dev/blog/npm-debug-and-chalk-p… | x_refsource_MISC |
| https://www.ox.security/blog/npm-packages-compromised | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Qix- | node-simple-swizzle |
Affected:
= 0.2.3
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-59141",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-16T13:47:43.689728Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-09-16T13:47:52.535Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "node-simple-swizzle",
"vendor": "Qix-",
"versions": [
{
"status": "affected",
"version": "= 0.2.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "simple-swizzle swizzles function arguments. On 8 September 2025, the npm publishing account for simple-swizzle was taken over after a phishing attack. Version 0.2.3 was published, functionally identical to the previous patch version, but with a malware payload added attempting to redirect cryptocurrency transactions to the attacker\u0027s own addresses from within browser environments. Local environments, server environments, command line applications, etc. are not affected. If the package was used in a browser context (e.g. a direct \u003cscript\u003e inclusion, or via a bundling tool such as Babel, Rollup, Vite, Next.js, etc.) there is a chance the malware still exists and such bundles will need to be rebuilt. The malware seemingly only targets cryptocurrency transactions and wallets such as MetaMask. npm removed the offending package from the registry over the course of the day on 8 September, preventing further downloads from npm proper. On 13 September, the package owner published new patch versions to help cache-bust those using private registries who might still have the compromised version cached. Users should update to the latest patch version, completely remove their node_modules directory, clean their package manager\u0027s global cache, and rebuild any browser bundles from scratch. Those operating private registries or registry mirrors should purge the offending versions from any caches. This issue is resolved in 0.2.4."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:A/U:Red",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-506",
"description": "CWE-506: Embedded Malicious Code",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-15T19:09:58.661Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Qix-/node-simple-swizzle/security/advisories/GHSA-9g9j-rggx-7fmg",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Qix-/node-simple-swizzle/security/advisories/GHSA-9g9j-rggx-7fmg"
},
{
"name": "https://github.com/debug-js/debug/issues/1005",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/debug-js/debug/issues/1005"
},
{
"name": "https://socket.dev/blog/npm-author-qix-compromised-in-major-supply-chain-attack",
"tags": [
"x_refsource_MISC"
],
"url": "https://socket.dev/blog/npm-author-qix-compromised-in-major-supply-chain-attack"
},
{
"name": "https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised",
"tags": [
"x_refsource_MISC"
],
"url": "https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised"
},
{
"name": "https://www.ox.security/blog/npm-packages-compromised",
"tags": [
"x_refsource_MISC"
],
"url": "https://www.ox.security/blog/npm-packages-compromised"
}
],
"source": {
"advisory": "GHSA-9g9j-rggx-7fmg",
"discovery": "UNKNOWN"
},
"title": "simple-swizzle@0.2.3 contains malware after npm account takeover"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-59141",
"datePublished": "2025-09-15T19:09:58.661Z",
"dateReserved": "2025-09-09T15:23:16.326Z",
"dateUpdated": "2025-09-16T13:47:52.535Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-59142 (GCVE-0-2025-59142)
Vulnerability from cvelistv5 – Published: 2025-09-15 19:10 – Updated: 2025-09-15 19:45
VLAI
Title
color-string@2.1.1 contains malware after npm account takeover
Summary
color-string is a parser and generator for CSS color strings. On 8 September 2025, the npm publishing account for color-string was taken over after a phishing attack. Version 2.1.1 was published, functionally identical to the previous patch version, but with a malware payload added attempting to redirect cryptocurrency transactions to the attacker's own addresses from within browser environments. Local environments, server environments, command line applications, etc. are not affected. If the package was used in a browser context (e.g. a direct <script> inclusion, or via a bundling tool such as Babel, Rollup, Vite, Next.js, etc.) there is a chance the malware still exists and such bundles will need to be rebuilt. The malware seemingly only targets cryptocurrency transactions and wallets such as MetaMask. npm removed the offending package from the registry over the course of the day on 8 September. On 13 September, the package owner published new patch versions to help cache-bust those using private registries who might still have the compromised version cached. This issue has been resolved in 2.1.2.
Severity
CWE
- CWE-506 - Embedded Malicious Code
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/Qix-/color-string/security/adv… | x_refsource_CONFIRM |
| https://github.com/debug-js/debug/issues/1005 | x_refsource_MISC |
| https://socket.dev/blog/npm-author-qix-compromise… | x_refsource_MISC |
| https://www.aikido.dev/blog/npm-debug-and-chalk-p… | x_refsource_MISC |
| https://www.ox.security/blog/npm-packages-compromised | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Qix- | color-string |
Affected:
= 2.1.1
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-59142",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-15T19:45:33.340598Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-09-15T19:45:39.946Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "color-string",
"vendor": "Qix-",
"versions": [
{
"status": "affected",
"version": "= 2.1.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "color-string is a parser and generator for CSS color strings. On 8 September 2025, the npm publishing account for color-string was taken over after a phishing attack. Version 2.1.1 was published, functionally identical to the previous patch version, but with a malware payload added attempting to redirect cryptocurrency transactions to the attacker\u0027s own addresses from within browser environments. Local environments, server environments, command line applications, etc. are not affected. If the package was used in a browser context (e.g. a direct \u003cscript\u003e inclusion, or via a bundling tool such as Babel, Rollup, Vite, Next.js, etc.) there is a chance the malware still exists and such bundles will need to be rebuilt. The malware seemingly only targets cryptocurrency transactions and wallets such as MetaMask. npm removed the offending package from the registry over the course of the day on 8 September. On 13 September, the package owner published new patch versions to help cache-bust those using private registries who might still have the compromised version cached. This issue has been resolved in 2.1.2."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:A/U:Red",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-506",
"description": "CWE-506: Embedded Malicious Code",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-15T19:10:07.595Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Qix-/color-string/security/advisories/GHSA-286p-vc9p-p5qv",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Qix-/color-string/security/advisories/GHSA-286p-vc9p-p5qv"
},
{
"name": "https://github.com/debug-js/debug/issues/1005",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/debug-js/debug/issues/1005"
},
{
"name": "https://socket.dev/blog/npm-author-qix-compromised-in-major-supply-chain-attack",
"tags": [
"x_refsource_MISC"
],
"url": "https://socket.dev/blog/npm-author-qix-compromised-in-major-supply-chain-attack"
},
{
"name": "https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised",
"tags": [
"x_refsource_MISC"
],
"url": "https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised"
},
{
"name": "https://www.ox.security/blog/npm-packages-compromised",
"tags": [
"x_refsource_MISC"
],
"url": "https://www.ox.security/blog/npm-packages-compromised"
}
],
"source": {
"advisory": "GHSA-286p-vc9p-p5qv",
"discovery": "UNKNOWN"
},
"title": "color-string@2.1.1 contains malware after npm account takeover"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-59142",
"datePublished": "2025-09-15T19:10:07.595Z",
"dateReserved": "2025-09-09T15:23:16.326Z",
"dateUpdated": "2025-09-15T19:45:39.946Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-59143 (GCVE-0-2025-59143)
Vulnerability from cvelistv5 – Published: 2025-09-15 19:10 – Updated: 2025-09-15 19:50
VLAI
Title
color@5.0.1 contains malware after npm account takeover
Summary
color is a Javascript color conversion and manipulation library. On 8 September 2025, the npm publishing account for color was taken over after a phishing attack. Version 5.0.1 was published, functionally identical to the previous patch version, but with a malware payload added attempting to redirect cryptocurrency transactions to the attacker's own addresses from within browser environments. Local environments, server environments, command line applications, etc. are not affected. If the package was used in a browser context (e.g. a direct <script> inclusion, or via a bundling tool such as Babel, Rollup, Vite, Next.js, etc.) there is a chance the malware still exists and such bundles will need to be rebuilt. The malware seemingly only targets cryptocurrency transactions and wallets such as MetaMask. npm removed the offending package from the registry over the course of the day on 8 September, preventing further downloads from npm proper. On 13 September, the package owner published new patch versions to help cache-bust those using private registries who might still have the compromised version cached. Users should update to the latest patch version, completely remove their node_modules directory, clean their package manager's global cache, and rebuild any browser bundles from scratch. Those operating private registries or registry mirrors should purge the offending versions from any caches. This issues has been resolved in 5.0.2.
Severity
CWE
- CWE-506 - Embedded Malicious Code
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/Qix-/color/security/advisories… | x_refsource_CONFIRM |
| https://github.com/debug-js/debug/issues/1005 | x_refsource_MISC |
| https://socket.dev/blog/npm-author-qix-compromise… | x_refsource_MISC |
| https://www.aikido.dev/blog/npm-debug-and-chalk-p… | x_refsource_MISC |
| https://www.ox.security/blog/npm-packages-compromised | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-59143",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-15T19:50:43.373770Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-09-15T19:50:50.772Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "color",
"vendor": "Qix-",
"versions": [
{
"status": "affected",
"version": "= 5.0.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "color is a Javascript color conversion and manipulation library. On 8 September 2025, the npm publishing account for color was taken over after a phishing attack. Version 5.0.1 was published, functionally identical to the previous patch version, but with a malware payload added attempting to redirect cryptocurrency transactions to the attacker\u0027s own addresses from within browser environments. Local environments, server environments, command line applications, etc. are not affected. If the package was used in a browser context (e.g. a direct \u003cscript\u003e inclusion, or via a bundling tool such as Babel, Rollup, Vite, Next.js, etc.) there is a chance the malware still exists and such bundles will need to be rebuilt. The malware seemingly only targets cryptocurrency transactions and wallets such as MetaMask. npm removed the offending package from the registry over the course of the day on 8 September, preventing further downloads from npm proper. On 13 September, the package owner published new patch versions to help cache-bust those using private registries who might still have the compromised version cached. Users should update to the latest patch version, completely remove their node_modules directory, clean their package manager\u0027s global cache, and rebuild any browser bundles from scratch. Those operating private registries or registry mirrors should purge the offending versions from any caches. This issues has been resolved in 5.0.2."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:A/U:Red",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-506",
"description": "CWE-506: Embedded Malicious Code",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-15T19:10:01.610Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Qix-/color/security/advisories/GHSA-qrmh-qg46-72pp",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Qix-/color/security/advisories/GHSA-qrmh-qg46-72pp"
},
{
"name": "https://github.com/debug-js/debug/issues/1005",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/debug-js/debug/issues/1005"
},
{
"name": "https://socket.dev/blog/npm-author-qix-compromised-in-major-supply-chain-attack",
"tags": [
"x_refsource_MISC"
],
"url": "https://socket.dev/blog/npm-author-qix-compromised-in-major-supply-chain-attack"
},
{
"name": "https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised",
"tags": [
"x_refsource_MISC"
],
"url": "https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised"
},
{
"name": "https://www.ox.security/blog/npm-packages-compromised",
"tags": [
"x_refsource_MISC"
],
"url": "https://www.ox.security/blog/npm-packages-compromised"
}
],
"source": {
"advisory": "GHSA-qrmh-qg46-72pp",
"discovery": "UNKNOWN"
},
"title": "color@5.0.1 contains malware after npm account takeover"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-59143",
"datePublished": "2025-09-15T19:10:01.610Z",
"dateReserved": "2025-09-09T15:23:16.326Z",
"dateUpdated": "2025-09-15T19:50:50.772Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-59144 (GCVE-0-2025-59144)
Vulnerability from cvelistv5 – Published: 2025-09-15 19:10 – Updated: 2025-09-15 19:46
VLAI
Title
debug@4.4.2 contains malware after npm account takeover
Summary
debug is a JavaScript debugging utility. On 8 September 2025, the npm publishing account for debug was taken over after a phishing attack. Version 4.4.2 was published, functionally identical to the previous patch version, but with a malware payload added attempting to redirect cryptocurrency transactions to the attacker's own addresses from within browser environments. Local environments, server environments, command line applications, etc. are not affected. If the package was used in a browser context (e.g. a direct <script> inclusion, or via a bundling tool such as Babel, Rollup, Vite, Next.js, etc.) there is a chance the malware still exists and such bundles will need to be rebuilt. The malware seemingly only targets cryptocurrency transactions and wallets such as MetaMask. npm removed the offending package from the registry over the course of the day on 8 September, preventing further downloads from npm proper. On 13 September, the package owner published new patch versions to help cache-bust those using private registries who might still have the compromised version cached. Users should upgrade to the latest patch version, completely remove their node_modules directory, clean their package manager's global cache, and rebuild any browser bundles from scratch. Those operating private registries or registry mirrors should purge the offending versions from any caches. This issue has been resolved in 4.4.3.
Severity
CWE
- CWE-506 - Embedded Malicious Code
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/debug-js/debug/security/adviso… | x_refsource_CONFIRM |
| https://github.com/debug-js/debug/issues/1005 | x_refsource_MISC |
| https://socket.dev/blog/npm-author-qix-compromise… | x_refsource_MISC |
| https://www.aikido.dev/blog/npm-debug-and-chalk-p… | x_refsource_MISC |
| https://www.ox.security/blog/npm-packages-compromised | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-59144",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-15T19:46:32.027005Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-09-15T19:46:39.190Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "debug",
"vendor": "debug-js",
"versions": [
{
"status": "affected",
"version": "= 4.4.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "debug is a JavaScript debugging utility. On 8 September 2025, the npm publishing account for debug was taken over after a phishing attack. Version 4.4.2 was published, functionally identical to the previous patch version, but with a malware payload added attempting to redirect cryptocurrency transactions to the attacker\u0027s own addresses from within browser environments. Local environments, server environments, command line applications, etc. are not affected. If the package was used in a browser context (e.g. a direct \u003cscript\u003e inclusion, or via a bundling tool such as Babel, Rollup, Vite, Next.js, etc.) there is a chance the malware still exists and such bundles will need to be rebuilt. The malware seemingly only targets cryptocurrency transactions and wallets such as MetaMask. npm removed the offending package from the registry over the course of the day on 8 September, preventing further downloads from npm proper. On 13 September, the package owner published new patch versions to help cache-bust those using private registries who might still have the compromised version cached. Users should upgrade to the latest patch version, completely remove their node_modules directory, clean their package manager\u0027s global cache, and rebuild any browser bundles from scratch. Those operating private registries or registry mirrors should purge the offending versions from any caches. This issue has been resolved in 4.4.3."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:A/U:Red",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-506",
"description": "CWE-506: Embedded Malicious Code",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-15T19:10:04.053Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/debug-js/debug/security/advisories/GHSA-4x49-vf9v-38px",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/debug-js/debug/security/advisories/GHSA-4x49-vf9v-38px"
},
{
"name": "https://github.com/debug-js/debug/issues/1005",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/debug-js/debug/issues/1005"
},
{
"name": "https://socket.dev/blog/npm-author-qix-compromised-in-major-supply-chain-attack",
"tags": [
"x_refsource_MISC"
],
"url": "https://socket.dev/blog/npm-author-qix-compromised-in-major-supply-chain-attack"
},
{
"name": "https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised",
"tags": [
"x_refsource_MISC"
],
"url": "https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised"
},
{
"name": "https://www.ox.security/blog/npm-packages-compromised",
"tags": [
"x_refsource_MISC"
],
"url": "https://www.ox.security/blog/npm-packages-compromised"
}
],
"source": {
"advisory": "GHSA-4x49-vf9v-38px",
"discovery": "UNKNOWN"
},
"title": "debug@4.4.2 contains malware after npm account takeover"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-59144",
"datePublished": "2025-09-15T19:10:04.053Z",
"dateReserved": "2025-09-09T15:23:16.326Z",
"dateUpdated": "2025-09-15T19:46:39.190Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-59145 (GCVE-0-2025-59145)
Vulnerability from cvelistv5 – Published: 2025-09-15 20:32 – Updated: 2025-09-15 20:39
VLAI
Title
color-name@2.0.1 contains malware after npm account takeover
Summary
color-name is a JSON with CSS color names. On 8 September 2025, an npm publishing account for color-name was taken over after a phishing attack. Version 2.0.1 was published, functionally identical to the previous patch version, but with a malware payload added attempting to redirect cryptocurrency transactions to the attacker's own addresses from within browser environments. Local environments, server environments, command line applications, etc. are not affected. If the package was used in a browser context (e.g. a direct <script> inclusion, or via a bundling tool such as Babel, Rollup, Vite, Next.js, etc.) there is a chance the malware still exists and such bundles will need to be rebuilt. The malware seemingly only targets cryptocurrency transactions and wallets such as MetaMask. See references below for more information on the payload. npm removed the offending package from the registry over the course of the day on 8 September, preventing further downloads from npm proper. On 13 September, the package owner published new patch versions to help cache-bust those using private registries who might still have the compromised version cached. Users should update to the latest patch version, completely remove their node_modules directory, clean their package manager's global cache, and rebuild any browser bundles from scratch. Those operating private registries or registry mirrors should purge the offending versions from any caches. This issue is resolved in 2.0.2.
Severity
CWE
- CWE-506 - Embedded Malicious Code
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/colorjs/color-name/security/ad… | x_refsource_CONFIRM |
| https://github.com/debug-js/debug/issues/1005 | x_refsource_MISC |
| https://socket.dev/blog/npm-author-qix-compromise… | x_refsource_MISC |
| https://www.aikido.dev/blog/npm-debug-and-chalk-p… | x_refsource_MISC |
| https://www.ox.security/blog/npm-packages-compromised | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| colorjs | color-name |
Affected:
= 2.0.1
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-59145",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-15T20:39:50.044627Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-09-15T20:39:58.389Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "color-name",
"vendor": "colorjs",
"versions": [
{
"status": "affected",
"version": "= 2.0.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "color-name is a JSON with CSS color names. On 8 September 2025, an npm publishing account for color-name was taken over after a phishing attack. Version 2.0.1 was published, functionally identical to the previous patch version, but with a malware payload added attempting to redirect cryptocurrency transactions to the attacker\u0027s own addresses from within browser environments. Local environments, server environments, command line applications, etc. are not affected. If the package was used in a browser context (e.g. a direct \u003cscript\u003e inclusion, or via a bundling tool such as Babel, Rollup, Vite, Next.js, etc.) there is a chance the malware still exists and such bundles will need to be rebuilt. The malware seemingly only targets cryptocurrency transactions and wallets such as MetaMask. See references below for more information on the payload. npm removed the offending package from the registry over the course of the day on 8 September, preventing further downloads from npm proper. On 13 September, the package owner published new patch versions to help cache-bust those using private registries who might still have the compromised version cached. Users should update to the latest patch version, completely remove their node_modules directory, clean their package manager\u0027s global cache, and rebuild any browser bundles from scratch. Those operating private registries or registry mirrors should purge the offending versions from any caches. This issue is resolved in 2.0.2."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:A/U:Red",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-506",
"description": "CWE-506: Embedded Malicious Code",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-15T20:32:43.877Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/colorjs/color-name/security/advisories/GHSA-5fvm-p68v-5wmh",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/colorjs/color-name/security/advisories/GHSA-5fvm-p68v-5wmh"
},
{
"name": "https://github.com/debug-js/debug/issues/1005",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/debug-js/debug/issues/1005"
},
{
"name": "https://socket.dev/blog/npm-author-qix-compromised-in-major-supply-chain-attack",
"tags": [
"x_refsource_MISC"
],
"url": "https://socket.dev/blog/npm-author-qix-compromised-in-major-supply-chain-attack"
},
{
"name": "https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised",
"tags": [
"x_refsource_MISC"
],
"url": "https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised"
},
{
"name": "https://www.ox.security/blog/npm-packages-compromised",
"tags": [
"x_refsource_MISC"
],
"url": "https://www.ox.security/blog/npm-packages-compromised"
}
],
"source": {
"advisory": "GHSA-5fvm-p68v-5wmh",
"discovery": "UNKNOWN"
},
"title": "color-name@2.0.1 contains malware after npm account takeover"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-59145",
"datePublished": "2025-09-15T20:32:43.877Z",
"dateReserved": "2025-09-09T15:23:16.326Z",
"dateUpdated": "2025-09-15T20:39:58.389Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-59162 (GCVE-0-2025-59162)
Vulnerability from cvelistv5 – Published: 2025-09-15 19:16 – Updated: 2025-09-15 19:43
VLAI
Title
color-convert@3.1.1 contains malware after npm account takeover
Summary
color-convert provides plain color conversion functions in JavaScript. On 8 September 2025, the npm publishing account for color-convert was taken over after a phishing attack. Version 3.1.1 was published, functionally identical to the previous patch version, but with a malware payload added attempting to redirect cryptocurrency transactions to the attacker's own addresses from within browser environments. Local environments, server environments, command line applications, etc. are not affected. If the package was used in a browser context (e.g. a direct <script> inclusion, or via a bundling tool such as Babel, Rollup, Vite, Next.js, etc.) there is a chance the malware still exists and such bundles will need to be rebuilt. The malware seemingly only targets cryptocurrency transactions and wallets such as MetaMask. npm removed the offending package from the registry over the course of the day on 8 September, preventing further downloads from npm proper. On 13 September, the package owner published new patch versions to help cache-bust those using private registries who might still have the compromised version cached. Users should update to the latest patch version, completely remove their node_modules directory, clean their package manager's global cache, and rebuild any browser bundles from scratch. Those operating private registries or registry mirrors should purge the offending versions from any caches. This issue is resolved in 3.1.2.
Severity
CWE
- CWE-506 - Embedded Malicious Code
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/Qix-/color-convert/security/ad… | x_refsource_CONFIRM |
| https://github.com/debug-js/debug/issues/1005 | x_refsource_MISC |
| https://socket.dev/blog/npm-author-qix-compromise… | x_refsource_MISC |
| https://www.aikido.dev/blog/npm-debug-and-chalk-p… | x_refsource_MISC |
| https://www.ox.security/blog/npm-packages-compromised | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Qix- | color-convert |
Affected:
= 3.1.1
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-59162",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-15T19:43:15.829675Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-09-15T19:43:24.241Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "color-convert",
"vendor": "Qix-",
"versions": [
{
"status": "affected",
"version": "= 3.1.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "color-convert provides plain color conversion functions in JavaScript. On 8 September 2025, the npm publishing account for color-convert was taken over after a phishing attack. Version 3.1.1 was published, functionally identical to the previous patch version, but with a malware payload added attempting to redirect cryptocurrency transactions to the attacker\u0027s own addresses from within browser environments. Local environments, server environments, command line applications, etc. are not affected. If the package was used in a browser context (e.g. a direct \u003cscript\u003e inclusion, or via a bundling tool such as Babel, Rollup, Vite, Next.js, etc.) there is a chance the malware still exists and such bundles will need to be rebuilt. The malware seemingly only targets cryptocurrency transactions and wallets such as MetaMask. npm removed the offending package from the registry over the course of the day on 8 September, preventing further downloads from npm proper. On 13 September, the package owner published new patch versions to help cache-bust those using private registries who might still have the compromised version cached. Users should update to the latest patch version, completely remove their node_modules directory, clean their package manager\u0027s global cache, and rebuild any browser bundles from scratch. Those operating private registries or registry mirrors should purge the offending versions from any caches. This issue is resolved in 3.1.2."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:A/U:Red",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-506",
"description": "CWE-506: Embedded Malicious Code",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-15T19:16:23.382Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Qix-/color-convert/security/advisories/GHSA-pxx3-g568-hxr4",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Qix-/color-convert/security/advisories/GHSA-pxx3-g568-hxr4"
},
{
"name": "https://github.com/debug-js/debug/issues/1005",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/debug-js/debug/issues/1005"
},
{
"name": "https://socket.dev/blog/npm-author-qix-compromised-in-major-supply-chain-attack",
"tags": [
"x_refsource_MISC"
],
"url": "https://socket.dev/blog/npm-author-qix-compromised-in-major-supply-chain-attack"
},
{
"name": "https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised",
"tags": [
"x_refsource_MISC"
],
"url": "https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised"
},
{
"name": "https://www.ox.security/blog/npm-packages-compromised",
"tags": [
"x_refsource_MISC"
],
"url": "https://www.ox.security/blog/npm-packages-compromised"
}
],
"source": {
"advisory": "GHSA-pxx3-g568-hxr4",
"discovery": "UNKNOWN"
},
"title": "color-convert@3.1.1 contains malware after npm account takeover"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-59162",
"datePublished": "2025-09-15T19:16:23.382Z",
"dateReserved": "2025-09-09T15:23:16.327Z",
"dateUpdated": "2025-09-15T19:43:24.241Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-59330 (GCVE-0-2025-59330)
Vulnerability from cvelistv5 – Published: 2025-09-15 19:19 – Updated: 2025-09-15 19:42
VLAI
Title
error-ex@1.3.3 contains malware after npm account takeover
Summary
error-ex allows error subclassing and stack customization. On 8 September 2025, an npm publishing account for error-ex was taken over after a phishing attack. Version 1.3.3 was published, functionally identical to the previous patch version, but with a malware payload added attempting to redirect cryptocurrency transactions to the attacker's own addresses from within browser environments. Local environments, server environments, command line applications, etc. are not affected. If the package was used in a browser context (e.g. a direct <script> inclusion, or via a bundling tool such as Babel, Rollup, Vite, Next.js, etc.) there is a chance the malware still exists and such bundles will need to be rebuilt. The malware seemingly only targets cryptocurrency transactions and wallets such as MetaMask. npm removed the offending package from the registry over the course of the day on 8 September, preventing further downloads from npm proper. On 13 September, the package owner published new patch versions to help cache-bust those using private registries who might still have the compromised version cached. Users should update to the latest patch version, completely remove their node_modules directory, clean their package manager's global cache, and rebuild any browser bundles from scratch. Those operating private registries or registry mirrors should purge the offending versions from any caches. This issue is resolved in 1.3.4.
Severity
CWE
- CWE-506 - Embedded Malicious Code
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/Qix-/node-error-ex/security/ad… | x_refsource_CONFIRM |
| https://github.com/debug-js/debug/issues/1005 | x_refsource_MISC |
| https://socket.dev/blog/npm-author-qix-compromise… | x_refsource_MISC |
| https://www.aikido.dev/blog/npm-debug-and-chalk-p… | x_refsource_MISC |
| https://www.ox.security/blog/npm-packages-compromised | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Qix- | node-error-ex |
Affected:
= 1.3.3
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-59330",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-15T19:42:18.034982Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-09-15T19:42:22.624Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "node-error-ex",
"vendor": "Qix-",
"versions": [
{
"status": "affected",
"version": "= 1.3.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "error-ex allows error subclassing and stack customization. On 8 September 2025, an npm publishing account for error-ex was taken over after a phishing attack. Version 1.3.3 was published, functionally identical to the previous patch version, but with a malware payload added attempting to redirect cryptocurrency transactions to the attacker\u0027s own addresses from within browser environments. Local environments, server environments, command line applications, etc. are not affected. If the package was used in a browser context (e.g. a direct \u003cscript\u003e inclusion, or via a bundling tool such as Babel, Rollup, Vite, Next.js, etc.) there is a chance the malware still exists and such bundles will need to be rebuilt. The malware seemingly only targets cryptocurrency transactions and wallets such as MetaMask. npm removed the offending package from the registry over the course of the day on 8 September, preventing further downloads from npm proper. On 13 September, the package owner published new patch versions to help cache-bust those using private registries who might still have the compromised version cached. Users should update to the latest patch version, completely remove their node_modules directory, clean their package manager\u0027s global cache, and rebuild any browser bundles from scratch. Those operating private registries or registry mirrors should purge the offending versions from any caches. This issue is resolved in 1.3.4."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:A/U:Red",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-506",
"description": "CWE-506: Embedded Malicious Code",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-15T19:19:22.213Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Qix-/node-error-ex/security/advisories/GHSA-6jp5-hh4c-8c5h",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Qix-/node-error-ex/security/advisories/GHSA-6jp5-hh4c-8c5h"
},
{
"name": "https://github.com/debug-js/debug/issues/1005",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/debug-js/debug/issues/1005"
},
{
"name": "https://socket.dev/blog/npm-author-qix-compromised-in-major-supply-chain-attack",
"tags": [
"x_refsource_MISC"
],
"url": "https://socket.dev/blog/npm-author-qix-compromised-in-major-supply-chain-attack"
},
{
"name": "https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised",
"tags": [
"x_refsource_MISC"
],
"url": "https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised"
},
{
"name": "https://www.ox.security/blog/npm-packages-compromised",
"tags": [
"x_refsource_MISC"
],
"url": "https://www.ox.security/blog/npm-packages-compromised"
}
],
"source": {
"advisory": "GHSA-6jp5-hh4c-8c5h",
"discovery": "UNKNOWN"
},
"title": "error-ex@1.3.3 contains malware after npm account takeover"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-59330",
"datePublished": "2025-09-15T19:19:22.213Z",
"dateReserved": "2025-09-12T12:36:24.634Z",
"dateUpdated": "2025-09-15T19:42:22.624Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
Mitigation
Phases: Implementation, Operation
Description:
- Remove the malicious code and start an effort to ensure that no more malicious code exists. This may require a detailed review of all code, as it is possible to hide a serious attack in only one or two lines of code. These lines may be located almost anywhere in an application and may have been intentionally obfuscated by the attacker.
CAPEC-442: Infected Software
An adversary adds malicious logic, often in the form of a computer virus, to otherwise benign software. This logic is often hidden from the user of the software and works behind the scenes to achieve negative impacts. Many times, the malicious logic is inserted into empty space between legitimate code, and is then called when the software is executed. This pattern of attack focuses on software already fielded and used in operation as opposed to software that is still under development and part of the supply chain.
CAPEC-448: Embed Virus into DLL
An adversary tampers with a DLL and embeds a computer virus into gaps between legitimate machine instructions. These gaps may be the result of compiler optimizations that pad memory blocks for performance gains. The embedded virus then attempts to infect any machine which interfaces with the product, and possibly steal private data or eavesdrop.
CAPEC-636: Hiding Malicious Data or Code within Files
Files on various operating systems can have a complex format which allows for the storage of other data, in addition to its contents. Often this is metadata about the file, such as a cached thumbnail for an image file. Unless utilities are invoked in a particular way, this data is not visible during the normal use of the file. It is possible for an attacker to store malicious data or code using these facilities, which would be difficult to discover.