CVE-2025-59162
BaseFortify
Publication date: 2025-09-15
Last updated on: 2025-09-16
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| qix | color-convert | 3.1.1 |
| debug | debug | 4.4.2 |
| qix | color-convert | 3.1.2 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-506 | The product contains code that appears to be malicious in nature. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability involves the npm package color-convert version 3.1.1, which was compromised after the maintainer's npm account was taken over via a phishing attack. The attacker published a malicious version that was functionally identical to the previous patch but included malware designed to intercept and redirect cryptocurrency transactions within browser environments to attacker-controlled addresses. This malware specifically targets cryptocurrency wallets like MetaMask and only operates in browser contexts, not affecting local, server, or command-line environments. [1]
How can this vulnerability impact me? :
If you use the color-convert package in a browser environment (such as through direct script inclusion or bundling tools like Babel, Rollup, Vite, Next.js), the malicious code could redirect your cryptocurrency transactions to attacker-controlled addresses, potentially resulting in financial loss. Local, server, and command-line uses of the package are not affected. To mitigate the risk, users should update to version 3.1.2, delete node_modules, clear package manager caches, and rebuild browser bundles. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking if your project uses color-convert version 3.1.1 in a browser context. You should inspect your package.json and package-lock.json or yarn.lock files for the version of color-convert. Additionally, check if any browser bundles include the compromised version. There are no specific commands provided in the resources, but typical commands include: `npm ls color-convert` to list installed versions, and searching your built bundles for suspicious code redirecting cryptocurrency transactions. Since the malware targets browser environments, monitoring network traffic for unexpected redirects to attacker-controlled cryptocurrency addresses could also help detect infection. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include: 1) Updating color-convert to version 3.1.2 or later. 2) Completely removing your node_modules directory. 3) Clearing your package manager's global cache. 4) Rebuilding any browser bundles from scratch to ensure no compromised code remains. 5) If you operate private registries or mirrors, purge the compromised version 3.1.1 from all caches. These steps ensure removal of the malicious payload and prevent further exploitation. [1]