CVE-2025-59140
BaseFortify
Publication date: 2025-09-15
Last updated on: 2025-09-16
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| npm | backslash | 0.2.1 |
| npm | backslash | 0.2.2 |
| metamask | metamask | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-506 | The product contains code that appears to be malicious in nature. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-59140 is a vulnerability in the npm package 'backslash' where the package's publishing account was taken over via a phishing attack. The attacker published a malicious version (0.2.1) that included malware designed to redirect cryptocurrency transactions to the attacker's addresses, but only when the package is used in browser environments. Local, server, and command-line environments are not affected. The malware targets cryptocurrency wallets such as MetaMask. The compromised package was removed from npm, and a patched version (0.2.2) was released to fix the issue. [1]
How can this vulnerability impact me? :
If you use the 'backslash' package in a browser context (such as via direct script inclusion or bundling tools like Babel, Rollup, Vite, Next.js), this vulnerability can lead to malware redirecting your cryptocurrency transactions to the attacker's addresses, potentially causing financial loss. Local, server, and command-line uses are not affected. To mitigate the risk, users should upgrade to version 0.2.2, remove node_modules directories, clear package manager caches, and rebuild browser bundles. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking if the compromised version 0.2.1 of the 'backslash' npm package is present in your browser bundles or node_modules directories. Since the malware only activates in browser environments, inspect your bundled JavaScript files for references to version 0.2.1 or suspicious code redirecting cryptocurrency transactions. You can use commands like 'npm list backslash' to check installed versions, and search your bundled files with 'grep -r "[email protected]" ./dist' or similar. Additionally, verify your package-lock.json or yarn.lock files for the compromised version. There are no specific commands provided in the resources, but these general npm and file search commands can help detect the presence of the vulnerable package. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include upgrading the 'backslash' package to version 0.2.2, which contains the fix. You should completely remove your node_modules directory, clear your package manager's global cache (e.g., 'npm cache clean --force'), and rebuild any browser bundles from scratch to ensure the malicious code is removed. If you operate private registries or mirrors, purge any cached compromised versions of the package. These steps will help eliminate the malware payload and prevent further exploitation. [1]