CVE-2025-59144: 
JavaScript vulnerability analysis and mitigation

CVE-2025-59144 is a supply chain compromise affecting the widely-used debug npm package (version 4.4.2), classified as embedded malicious code (CWE-506). On September 8, 2025, an attacker gained control of the npm publishing account for debug via a phishing attack and published version 4.4.2 containing a malware payload designed to redirect cryptocurrency transactions to attacker-controlled addresses in browser environments. The advisory was published on September 15, 2025, with a patch released as version 4.4.3. It carries a CVSS v4 base score of 8.8 (High) (GitHub Advisory, debug-js Security Advisory).

The root cause is a supply chain attack (CWE-506: Embedded Malicious Code) achieved through account takeover via phishing of the npm maintainer account for the debug package. The attacker published version 4.4.2, which is functionally identical to the prior legitimate version but includes an injected malicious payload in src/index.js that activates only in browser environments (i.e., when typeof window !== 'undefined'). The payload targets cryptocurrency wallet interactions — specifically wallets like MetaMask — by intercepting and redirecting transaction addresses to attacker-controlled ones. Server-side Node.js environments, CLI tools, and non-browser runtimes are unaffected because the malicious code is gated on the presence of a browser window object (GitHub Advisory, debug-js Issue #1005).

The primary impact is financial theft: users of browser-based applications that bundle debug@4.4.2 (via tools such as Babel, Rollup, Vite, or Next.js) may have had cryptocurrency transactions silently redirected to the attacker's wallet addresses. Confidentiality impact is low (partial exposure of wallet/transaction data), while integrity impact is high due to unauthorized modification of transaction destinations. Availability is not affected. Applications that only use debug in server-side or CLI contexts are not impacted (GitHub Advisory).

1. Account Takeover: The attacker phished the npm publishing credentials of the debug package maintainer (account: Qix-), gaining the ability to publish new versions to the npm registry.
2. Malicious Package Publication: The attacker published debug@4.4.2 to npm on September 8, 2025 — a version functionally identical to the prior legitimate release but with a malicious payload injected into src/index.js.
3. Payload Activation: The injected code checks for a browser environment (typeof window !== 'undefined'). If running in a browser, the payload activates and hooks into cryptocurrency transaction flows.
4. Cryptocurrency Redirection: When a user interacts with a cryptocurrency wallet (e.g., MetaMask) in an application that bundled the compromised package, the malware silently replaces the destination wallet address with the attacker's address, redirecting funds.
5. Persistence via Bundled Artifacts: Even after npm removed the package, any previously built browser bundles (e.g., via Vite, Rollup, Next.js, Babel) that included debug@4.4.2 remained compromised until explicitly rebuilt (GitHub Advisory, debug-js Issue #1005).

• File System: Presence of debug@4.4.2 in node_modules/debug/package.json ("version": "4.4.2"); suspicious or unexpected code in node_modules/debug/src/index.js that references window or wallet/transaction-related strings.
• Package Lock / Dependency Files: package-lock.json, yarn.lock, or pnpm-lock.yaml referencing debug version 4.4.2.
• Browser Bundles: Built JavaScript bundles (e.g., .js files in dist/ or .next/) containing obfuscated code referencing cryptocurrency address patterns or MetaMask-related strings injected by the malware.
• Network: Outbound browser-side requests to unexpected or attacker-controlled endpoints associated with cryptocurrency transaction interception (specific C2 addresses not publicly confirmed at time of reporting).
• Private Registry / Cache: Cached copies of debug@4.4.2 in private npm registries (e.g., Artifactory, Verdaccio) or local package manager caches (~/.npm, ~/.pnpm-store) (GitHub Advisory, debug-js Issue #1005).

Users should immediately upgrade to debug@4.4.3 (or the latest patch version), which is functionally identical to the last known-good version and was published on September 13, 2025 specifically to cache-bust compromised cached versions. After upgrading, completely remove the node_modules directory, clean the package manager's global cache (e.g., npm cache clean --force), and rebuild all browser bundles from scratch. Organizations operating private npm registries or mirrors must purge debug@4.4.2 from all caches to prevent re-installation. If suspicious behavior persists after remediation, contact the package owner via the debug tracking issue (GitHub Advisory, debug-js Security Advisory).

The incident was quickly picked up by multiple security vendors and researchers. Aikido Security published a blog post analyzing the compromised debug and chalk packages, while Socket.dev covered the account takeover of the maintainer Qix- in detail. OX Security also published analysis of the broader npm package compromise. The package maintainer (Qix-) was transparent and responsive, posting updates directly in the GitHub tracking issue and publishing a clean patch version within days. The incident highlighted ongoing risks of npm account takeover via phishing as a supply chain attack vector (Aikido Security, Socket.dev, OX Security).