CVE-2025-59145: 
JavaScript vulnerability analysis and mitigation

On September 8, 2025, the npm package color-name was compromised when an attacker gained access to the maintainer's publishing account through a phishing attack. Version 2.0.1 was published containing malware that attempts to redirect cryptocurrency transactions to attacker-controlled addresses when used in browser environments (GitHub Advisory, Socket Blog).

The malicious version 2.0.1 was functionally identical to the previous patch version but included an obfuscated malware payload. The malware only activates in browser environments and targets cryptocurrency transactions, specifically attempting to intercept and redirect payments to attacker-controlled wallets. The package has a CVSS v4.0 score of 8.8 (HIGH) with vector string CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:A/U:Red (GitHub Advisory).

The compromised package primarily affects browser-based applications using color-name, particularly those handling cryptocurrency transactions. Local environments, server environments, and command line applications are not affected. The package receives approximately 191.71 million downloads per week, creating a significant potential impact surface (Socket Blog).

npm removed the malicious package from the registry on September 8, preventing further downloads. On September 13, the package owner published version 2.0.2 to help cache-bust private registries that might still have the compromised version. Users should update to the latest patch version, completely remove their node_modules directory, clean their package manager's global cache, and rebuild any browser bundles from scratch. Those operating private registries should purge the offending versions from their caches (GitHub Advisory).

The incident was part of a larger supply chain attack affecting multiple popular npm packages maintained by the same author. The attack was discovered and reported by several security firms and researchers, highlighting the ongoing challenges of supply chain security in the npm ecosystem (Socket Blog).