CVE-2025-59145
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-09-15

Last updated on: 2025-09-16

Assigner: GitHub, Inc.

Description
color-name is a JSON with CSS color names. On 8 September 2025, an npm publishing account for color-name was taken over after a phishing attack. Version 2.0.1 was published, functionally identical to the previous patch version, but with a malware payload added attempting to redirect cryptocurrency transactions to the attacker's own addresses from within browser environments. Local environments, server environments, command line applications, etc. are not affected. If the package was used in a browser context (e.g. a direct <script> inclusion, or via a bundling tool such as Babel, Rollup, Vite, Next.js, etc.) there is a chance the malware still exists and such bundles will need to be rebuilt. The malware seemingly only targets cryptocurrency transactions and wallets such as MetaMask. See references below for more information on the payload. npm removed the offending package from the registry over the course of the day on 8 September, preventing further downloads from npm proper. On 13 September, the package owner published new patch versions to help cache-bust those using private registries who might still have the compromised version cached. Users should update to the latest patch version, completely remove their node_modules directory, clean their package manager's global cache, and rebuild any browser bundles from scratch. Those operating private registries or registry mirrors should purge the offending versions from any caches. This issue is resolved in 2.0.2.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-09-15
Last Modified
2025-09-16
Generated
2026-05-07
AI Q&A
2025-09-16
EPSS Evaluated
2026-05-05
NVD
CVE-2025-59145
EUVD
EUVD-2025-29260
Affected Vendors & Products
Showing 3 associated CPEs
Vendor Product Version / Range
npm color-name 2.0.1
npm debug 4.4.2
npm color-name 2.0.2
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-506 The product contains code that appears to be malicious in nature.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

The vulnerability involves the npm package 'color-name', which was compromised after a phishing attack on the publishing account. A malicious version 2.0.1 was published containing malware that attempts to redirect cryptocurrency transactions to the attacker's addresses when used in browser environments. Local, server, and command line environments are not affected. Users who included this package in browser contexts may have been exposed to this malware.


How can this vulnerability impact me? :

If you use the 'color-name' package in browser environments, the malware could redirect your cryptocurrency transactions and wallets (such as MetaMask) to the attacker's addresses, potentially causing financial loss. Local or server-side uses are not affected. To mitigate, users should update to version 2.0.2, clear caches, and rebuild browser bundles.


What immediate steps should I take to mitigate this vulnerability?

To mitigate this vulnerability, update the color-name package to version 2.0.2 or later, completely remove your node_modules directory, clean your package manager's global cache, and rebuild any browser bundles from scratch. If you operate private registries or registry mirrors, purge the offending versions from any caches.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart