CVE-2025-59143: 
JavaScript vulnerability analysis and mitigation

CVE-2025-59143 is a supply chain compromise affecting the color npm package (version 5.0.1), a widely used JavaScript color conversion and manipulation library. On September 8, 2025, the npm publishing account for color was taken over via a phishing attack, and a malicious version (5.0.1) was published containing an embedded malware payload designed to redirect cryptocurrency transactions to the attacker's addresses in browser environments. The vulnerability was publicly disclosed on September 15, 2025, and carries a CVSS v4 base score of 8.8 (High) (GitHub Advisory). Only the npm package version 5.0.1 is affected; the patched version is 5.0.2 (GitHub Advisory).

The root cause is classified as CWE-506 (Embedded Malicious Code): the attacker gained control of the legitimate npm publisher account through phishing and injected a malicious payload into an otherwise functionally identical release of the package (GitHub Advisory). The malware payload is browser-specific — it checks for a browser context (e.g., typeof window !== 'undefined') and, when present, attempts to intercept and redirect cryptocurrency transactions, specifically targeting wallets such as MetaMask. Applications bundling color@5.0.1 via tools like Babel, Rollup, Vite, or Next.js, or including it directly via <script> tags, are at risk; Node.js server-side, CLI, and local environments are not affected (GitHub Advisory, debug tracking issue).

The primary impact is financial theft: the malware silently redirects cryptocurrency transactions initiated in browser-based applications to attacker-controlled wallet addresses, targeting users of wallets such as MetaMask. Confidentiality impact is low (some wallet/transaction data may be exposed to the attacker), while integrity impact is high due to unauthorized modification of transaction destinations. Availability is not affected, and server-side or non-browser deployments are entirely out of scope (GitHub Advisory). Any web application that bundled color@5.0.1 and handles cryptocurrency transactions may have exposed its end users to financial loss.

1. Account Takeover: The attacker conducted a phishing attack against the npm publishing account of the color package maintainer (Qix-), gaining credentials to publish new package versions.
2. Malicious Package Publication: The attacker published color@5.0.1 to npm, which was functionally identical to the prior legitimate version but included an embedded malware payload in the JavaScript source.
3. Browser Environment Detection: When the compromised package is loaded in a browser context, the malware checks for typeof window to confirm it is running in a browser (not Node.js or CLI), activating only in browser environments.
4. Cryptocurrency Transaction Interception: In browser environments, the payload intercepts cryptocurrency transaction flows (e.g., from MetaMask or similar wallet integrations) and silently substitutes the attacker's wallet address for the intended recipient address.
5. Funds Redirected: Users initiating cryptocurrency transactions in affected web applications unknowingly send funds to the attacker's addresses instead of the intended destination (GitHub Advisory, Socket.dev blog).

• File System: Presence of color@5.0.1 in node_modules/color/package.json (version field equals 5.0.1); unexpected or obfuscated code in node_modules/color/index.js or related files that references wallet addresses or transaction manipulation logic.
• Build Artifacts: Browser bundles (e.g., Webpack, Rollup, Vite, Next.js output) built after September 8, 2025 that include color@5.0.1 may contain the malicious payload embedded in minified JavaScript.
• Network: Outbound browser-side requests to unknown or attacker-controlled endpoints associated with cryptocurrency address substitution; unexpected wallet address changes during transaction signing in MetaMask or similar browser wallet extensions.
• Package Registry: Presence of color@5.0.1 in private npm registry caches or mirrors; audit logs showing download of color@5.0.1 between September 8–8 (end of day), 2025 (GitHub Advisory).

The patched version is color@5.0.2, published by the package owner on September 13, 2025 to cache-bust private registries still holding the compromised version (GitHub Advisory). Remediation steps in priority order:

1. Update color to 5.0.2 or later in package.json.
2. Completely delete the node_modules directory.
3. Clear the package manager's global cache (e.g., npm cache clean --force).
4. Rebuild all browser bundles from scratch.
5. For private registries or mirrors, purge all cached copies of color@5.0.1.
6. Audit all browser-based applications that used color to assess exposure to cryptocurrency transaction redirection.

The incident attracted significant attention from the security community as part of a broader supply chain attack affecting multiple npm packages maintained by the same author (Qix-), including debug and chalk. Aikido Security and Socket.dev published detailed blog posts analyzing the malware payload and the scope of the compromise (Aikido blog, Socket.dev blog). OX Security also published analysis covering the broader npm package compromise (OX Security blog). The debug repository's GitHub issue tracker served as a central coordination point for the community response, with the package maintainer (Qix-) providing updates directly (debug tracking issue).