CVE-2025-59331: 
JavaScript vulnerability analysis and mitigation

On September 8, 2025, the npm publishing account for is-arrayish was compromised through a phishing attack. The attacker published version 0.3.3, which was functionally identical to the previous patch version but contained a malicious payload designed to redirect cryptocurrency transactions to attacker-controlled addresses within browser environments (GitHub Advisory, Socket Blog).

The malicious version 0.3.3 contained obfuscated code that specifically targeted browser environments, leaving local environments, server environments, and command line applications unaffected. The malware was designed to intercept and manipulate cryptocurrency transactions, particularly targeting cryptocurrency wallets such as MetaMask. The package received a CVSS v4.0 score of 8.8 (HIGH) with the vector string CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:A/U:Red (GitHub Advisory).

The vulnerability affects applications that use is-arrayish in a browser context, including those using bundling tools such as Babel, Rollup, Vite, and Next.js. The malware specifically targets cryptocurrency transactions and wallets, attempting to redirect funds to attacker-controlled addresses (GitHub Advisory, Aikido Blog).

npm removed the malicious package from the registry on September 8, preventing further downloads. On September 13, the package owner published version 0.3.4 to help cache-bust private registries that might still have the compromised version cached. Users should update to the latest patch version, completely remove their node_modules directory, clean their package manager's global cache, and rebuild any browser bundles from scratch. Those operating private registries or registry mirrors should purge the offending versions from any caches (GitHub Advisory).

The incident was widely reported across the security community, with multiple security firms and researchers analyzing and documenting the attack. The compromise was particularly notable as it affected several popular npm packages with billions of weekly downloads collectively (Socket Blog, Aikido Blog).