CVE-2025-59140: 
JavaScript vulnerability analysis and mitigation

CVE-2025-59140 is a supply chain vulnerability affecting the backslash npm package (version 0.2.1), classified as CWE-506 (Embedded Malicious Code). On 8 September 2025, the npm publishing account for the package was taken over via a phishing attack, and a malicious version was published containing a payload designed to redirect cryptocurrency transactions to the attacker's wallet addresses in browser environments. The advisory was published on 15 September 2025 by the package owner (Qix-) and the GitHub Advisory Database. Only version 0.2.1 is affected; version 0.2.2 is the patched release. The CVSS v4 base score is 8.8 (High) (GitHub Advisory, GHSA).

The root cause is a supply chain compromise (CWE-506: Embedded Malicious Code) achieved through a phishing attack that granted the threat actor control of the npm publishing account for backslash. The attacker published version 0.2.1, which was functionally identical to the prior legitimate version but included a hidden malware payload targeting browser environments — specifically checking for typeof window to confirm a browser context before activating. The payload intercepts and redirects cryptocurrency transactions (e.g., from MetaMask wallets) to attacker-controlled addresses. Server-side, CLI, and Node.js environments are not affected because the malware only activates when window is defined (GitHub Advisory, debug-js issue).

The primary impact is financial theft: users of cryptocurrency wallets such as MetaMask who visited web applications bundled with the compromised backslash@0.2.1 package could have their cryptocurrency transactions silently redirected to the attacker's addresses. The malware is scoped exclusively to browser environments (e.g., applications built with Babel, Rollup, Vite, Next.js, or direct <script> inclusion), meaning server-side, CLI, and Node.js-only deployments are unaffected. Integrity of cryptocurrency transactions is the primary concern, with low confidentiality impact (potential exposure of wallet-related data) and no availability impact (GitHub Advisory, GHSA).

The malware was actively deployed via the npm registry on 8 September 2025 and was available for download until npm removed it later that same day, representing a confirmed in-the-wild supply chain attack. The CVSS v4 exploit maturity is rated "Attacked" (E:A), indicating active exploitation. The EPSS score is approximately 0.047%–0.138% (34th percentile), reflecting the narrow but real-world exploitation window. No public proof-of-concept exploit code is separately available, as the malware itself was embedded in the published package. The attack is attributed to an unknown threat actor who compromised the npm account of developer Qix- through phishing (GitHub Advisory, socket.dev blog).

1. Account Takeover via Phishing: The attacker targeted the npm publishing account of the backslash package maintainer (Qix-) with a phishing attack, gaining credentials to publish new package versions.
2. Malicious Package Publication: The attacker published backslash@0.2.1 to the npm registry on 8 September 2025, embedding a malware payload while keeping the package functionally identical to the prior legitimate version to avoid detection.
3. Payload Activation Check: The embedded malware checks for typeof window !== 'undefined' to confirm a browser context before activating, ensuring it only runs in web browser environments.
4. Cryptocurrency Transaction Interception: In browser contexts, the malware intercepts outgoing cryptocurrency transactions (targeting wallets such as MetaMask) and silently replaces the destination wallet address with the attacker's own address.
5. Victim Impact: End users of web applications that bundled backslash@0.2.1 (via Babel, Rollup, Vite, Next.js, or direct script inclusion) unknowingly send cryptocurrency to the attacker's wallet when initiating transactions (GitHub Advisory, debug-js issue).

• File System: Presence of backslash@0.2.1 in node_modules/backslash/package.json (check "version": "0.2.1"); browser bundles built between 8–8 September 2025 that include the backslash package.
• Package Registry: backslash version 0.2.1 present in package-lock.json, yarn.lock, or pnpm-lock.yaml; cached version 0.2.1 in private npm registry or registry mirror.
• Network: Unexpected outbound cryptocurrency transaction requests to unfamiliar wallet addresses originating from browser-based applications; anomalous MetaMask transaction destinations not matching user-initiated addresses.
• Logs: Build logs referencing backslash@0.2.1 as a resolved dependency during the 8 September 2025 window; npm audit warnings or alerts for GHSA-53mq-f4w3-f7qv (GitHub Advisory).

The patched version is backslash@0.2.2, published by the legitimate package owner on 13 September 2025 to supersede the compromised version. Users should: (1) upgrade to backslash@0.2.2 or later; (2) completely delete the node_modules directory; (3) clear the package manager's global cache (npm cache clean --force, yarn cache clean, etc.); (4) rebuild all browser bundles from scratch to eliminate any cached malicious code. Operators of private npm registries or registry mirrors must purge backslash@0.2.1 from their caches to prevent continued distribution. npm removed the offending package from the public registry on 8 September 2025 (GHSA, GitHub Advisory).

The incident attracted significant attention from the security community as part of a broader supply chain attack affecting multiple npm packages maintained by the same developer (Qix-), including debug and chalk. Socket.dev published a detailed blog post describing the compromise as a "major supply chain attack" and analyzing the malware payload. Aikido Security and OX Security also published analyses linking the backslash compromise to the broader breach of the Qix- npm account. The debug package's GitHub repository saw a high-traffic tracking issue (#1005) opened by the community on the day of the attack, which was later resolved (socket.dev blog, Aikido blog, OX Security blog, debug-js issue).