CVE-2025-59145: 
JavaScript vulnerability analysis and mitigation

CVE-2025-59145 is a supply chain vulnerability affecting the color-name npm package, classified as CWE-506 (Embedded Malicious Code). On September 8, 2025, an attacker gained control of the npm publishing account for color-name via a phishing attack and published version 2.0.1, which contained a malware payload designed to redirect cryptocurrency transactions to attacker-controlled addresses in browser environments. The vulnerability was disclosed on September 15, 2025, and only affects color-name version 2.0.1; all other versions are unaffected. It carries a CVSS v4 base score of 8.8 (High) (GitHub Advisory, color-name Advisory).

The root cause is a compromised npm publishing account (obtained via phishing), which allowed the attacker to inject malicious code into an otherwise legitimate package release — classified as CWE-506 (Embedded Malicious Code). The malware payload in version 2.0.1 is functionally identical to the prior clean version but includes additional code that intercepts and redirects cryptocurrency transactions (e.g., targeting MetaMask wallet interactions) when the package is executed in a browser context. The payload is specifically conditioned on typeof window !== 'undefined', meaning it only activates in browser environments and is inert in Node.js server-side, CLI, or local environments. Applications bundled with tools such as Babel, Rollup, Vite, or Next.js that included this version may have shipped the malicious code to end users (GitHub Advisory, debug-js Issue).

The primary impact is financial theft: the malware silently redirects cryptocurrency transactions initiated in browser-based applications to attacker-controlled wallet addresses, targeting users of wallets such as MetaMask. Confidentiality is marginally impacted (low) as wallet addresses or transaction metadata may be exposed, while integrity is highly impacted due to unauthorized modification of transaction destinations. Server-side, CLI, and local environments are entirely unaffected; only end users of web applications that bundled the compromised package are at risk (GitHub Advisory, color-name Advisory).

1. Account Takeover: The attacker conducted a phishing attack against the npm account owner ("qix") to obtain publishing credentials for the color-name package.
2. Malicious Package Publication: Using the compromised credentials, the attacker published color-name@2.0.1 to the npm registry — a version functionally identical to the prior clean release but with an embedded malware payload.
3. Supply Chain Distribution: Developers or CI/CD pipelines that ran npm install or equivalent commands during the window of availability (September 8, 2025) downloaded and installed the compromised version, potentially bundling it into browser-facing applications via tools like Webpack, Vite, Rollup, or Next.js.
4. Browser-Side Activation: When an end user visited a web application containing the malicious bundle, the payload activated (conditioned on typeof window !== 'undefined') and began monitoring cryptocurrency transaction activity.
5. Transaction Hijacking: The malware intercepted outgoing cryptocurrency transactions (e.g., via MetaMask) and silently replaced the destination wallet address with the attacker's own address, redirecting funds (GitHub Advisory, debug-js Issue).

• File System: Presence of color-name@2.0.1 in node_modules/color-name/package.json (check "version": "2.0.1"); unexpected or obfuscated JavaScript code in the color-name package source files beyond the standard color name mappings.
• Build Artifacts: Browser bundles (e.g., .js files produced by Webpack, Vite, Rollup, Next.js) containing references to attacker-controlled cryptocurrency wallet addresses or suspicious transaction-interception logic.
• Network: Outbound browser requests to unknown or attacker-controlled endpoints coinciding with cryptocurrency wallet interactions (e.g., MetaMask transaction signing events).
• Package Lock Files: package-lock.json or yarn.lock entries pinning color-name to version 2.0.1 with a hash that does not match the legitimate prior release.
• Registry/Cache: Presence of color-name@2.0.1 in private npm registry caches or local package manager caches (e.g., ~/.npm, ~/.yarn/cache) (GitHub Advisory).

Update color-name to version 2.0.2 or later, which is a clean patch release published by the legitimate package owner on September 13, 2025, specifically to cache-bust compromised cached versions. After updating, completely remove the node_modules directory, clear the package manager's global cache (e.g., npm cache clean --force), and rebuild all browser bundles from scratch to ensure no malicious code persists in build artifacts. Organizations operating private npm registries or registry mirrors must purge color-name@2.0.1 from their caches. Verify no browser-facing bundles shipped to production contain the compromised version (color-name Advisory, GitHub Advisory).

The incident was part of a broader supply chain attack affecting multiple npm packages maintained by the same author ("qix"), including debug and chalk, which drew significant attention from the security community. Aikido Security, Socket.dev, and OX Security each published detailed technical analyses of the payload and the broader compromise (GitHub Advisory). The debug-js/debug repository tracking issue (#1005) served as a central coordination point for affected maintainers and users. Social media discussion on Mastodon (infosec.exchange) and Bluesky highlighted the incident shortly after discovery on September 8, 2025.