CVE-2025-59038: 
JavaScript vulnerability analysis and mitigation

CVE-2025-59038 is a supply chain compromise affecting the Prebid.js npm package (version 10.9.2), classified as Embedded Malicious Code (CWE-506). The malicious code was injected into the prebid.js and prebid npm packages (both at version 10.9.2) as part of a broader npm account takeover campaign that also affected widely used packages such as chalk, debug, and over a dozen others. The vulnerability was disclosed on September 9, 2025, with version 10.10.0 released as the fix. It carries a CVSS v4.0 base score of 8.6 (High), assigned by GitHub (GitHub Advisory, Sonatype Blog).

The root cause is a software supply chain attack (CWE-506: Embedded Malicious Code) in which a threat actor gained control of a developer's npm account and published a malicious version of the prebid.js and prebid packages. The injected payload was designed to intercept and redirect cryptocurrency transactions on websites using the compromised library to an attacker-controlled wallet. Sonatype's analysis confirmed the payload was obfuscated and followed the same backdoor pattern as other packages compromised in the same campaign (tracked as sonatype-2025-003716 and sonatype-2025-003727). The attack required no special privileges — any site that installed or updated to prebid.js@10.9.2 or prebid@10.9.2 from npm would have incorporated the malicious code (GitHub Advisory, Sonatype Blog).

Websites using the compromised prebid.js@10.9.2 package were at risk of having cryptocurrency transactions silently redirected to the attacker's wallet, resulting in direct financial losses for end users. Beyond immediate crypto theft, the broader campaign demonstrated that compromised packages could also be used to harvest API keys, tokens, and other sensitive credentials, or to establish persistent backdoors for future lateral movement within affected organizations. The attack's reach was amplified by the popularity of the affected packages and the trust placed in them by downstream developers and publishers (Sonatype Blog, GitHub Advisory).

No public proof-of-concept exploit code has been identified, and there is no confirmed evidence of active exploitation beyond the malicious package being briefly available on npm. The EPSS score is 0.000440, indicating a low probability of exploitation in the wild at this time. The attack was passive by design — any developer or CI/CD pipeline that ran npm install prebid.js or npm install prebid during the window when version 10.9.2 was live would have automatically incorporated the malicious payload without any additional attacker interaction. The campaign has been attributed to a threat actor who used npm account takeover as the initial access vector, a tactic associated with advanced persistent threat (APT) groups such as the Lazarus Group in similar prior incidents (Sonatype Blog, GitHub Advisory). This CVE is not currently listed in the CISA KEV catalog.

1. Account Takeover: The threat actor compromised a developer's npm account (likely via credential theft or phishing), gaining publishing rights to the prebid.js and prebid packages.
2. Malicious Package Publication: The attacker published version 10.9.2 of prebid.js and prebid to the npm registry, embedding an obfuscated malicious payload alongside the legitimate library code.
3. Victim Installation: Any developer, CI/CD pipeline, or automated dependency update process that ran npm install prebid.js@10.9.2 or npm install prebid@10.9.2 (or resolved to this version via semver ranges) would pull down the backdoored package.
4. Payload Execution: When the compromised library was loaded in a browser on a website handling cryptocurrency transactions, the malicious code activated and intercepted transaction data.
5. Crypto Redirection: The payload silently replaced the legitimate destination wallet address with the attacker's wallet address, causing any cryptocurrency transactions initiated by site visitors to be sent to the attacker instead of the intended recipient (Sonatype Blog, GitHub Advisory).

• File System / Package: Presence of prebid.js@10.9.2 or prebid@10.9.2 in node_modules, package.json, or package-lock.json; also check for prebid-universal-creative@1.17.3 and proto-tinker-wc@0.1.87 which were part of the same campaign.
• SBOM / Dependency Audit: SBOM entries or SCA scan results listing any of the following compromised package versions: chalk@5.6.1, debug@4.4.2, prebid@10.9.2, prebid.js@10.9.2, ansi-regex@6.2.1, color@5.0.1, duckdb@1.3.3, or other packages listed in the Sonatype advisory.
• Network: Outbound cryptocurrency transaction data or wallet addresses being sent to unexpected or attacker-controlled endpoints from web application servers or browsers.
• Logs: npm install logs or CI/CD pipeline logs showing installation of prebid.js@10.9.2 or prebid@10.9.2 during the compromise window (around September 9, 2025).
• Browser / Runtime: Unexpected modification of cryptocurrency wallet addresses in transaction flows on publisher websites using Prebid.js (Sonatype Blog, GitHub Advisory).

The primary remediation is to upgrade to prebid.js@10.10.0 (or prebid@10.10.0), which removes the malicious code (GitHub Release). As an alternative workaround, organizations can downgrade to version 10.9.1, which predates the compromise (GitHub Advisory). Organizations should immediately audit their SBOMs and dependency trees for the presence of any compromised package versions listed in the Sonatype advisory, treat any affected systems as potentially compromised, and review cryptocurrency transaction processes on affected websites for signs of unauthorized redirection. Enabling npm MFA for all publishing accounts and implementing SCA tooling in CI/CD pipelines are recommended preventive measures (Sonatype Blog).

Sonatype's Security Research Team published a detailed blog post on September 9, 2025, contextualizing the Prebid.js compromise within a broader npm supply chain attack campaign affecting over 20 packages — including widely used libraries like chalk and debug — with a collective download volume exceeding 2 billion per week. Sonatype drew parallels to APT tactics, specifically referencing the Lazarus Group's known use of supply chain attacks, and emphasized that open source maintainers are increasingly the frontline target for sophisticated adversaries. The incident prompted calls from the security community for improved npm account security (MFA enforcement), SBOM adoption, and automated SCA tooling as essential defenses against supply chain compromise (Sonatype Blog).