CVE-2025-59330
BaseFortify
Publication date: 2025-09-15
Last updated on: 2025-09-16
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| ansi-styles | ansi-styles | 6.2.2 |
| proto-tinker-wc | proto-tinker-wc | 1.8.7 |
| color-convert | color-convert | 3.1.1 |
| supports-color | supports-color | 10.2.1 |
| color-string | color-string | 2.1.1 |
| wrap-ansi | wrap-ansi | 9.0.1 |
| chalk-template | chalk-template | 1.1.1 |
| ansi-regex | ansi-regex | 6.2.1 |
| strip-ansi | strip-ansi | 7.1.1 |
| qix | error-ex | 1.3.4 |
| supports-hyperlinks | supports-hyperlinks | 4.1.1 |
| is-arrayish | is-arrayish | 0.3.3 |
| simple-swizzle | simple-swizzle | 0.2.3 |
| chalk | chalk | 5.6.1 |
| has-ansi | has-ansi | 6.0.1 |
| debug | debug | 4.4.2 |
| qix | error-ex | 1.3.3 |
| color-name | color-name | 2.0.1 |
| slice-ansi | slice-ansi | 7.1.1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-506 | The product contains code that appears to be malicious in nature. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-59330 is a supply chain attack on the npm package "error-ex" where the attacker's phishing compromised the npm publishing account and published a malicious version 1.3.3. This version contained malware that redirected cryptocurrency transactions to the attacker's addresses, but only when the package was used in browser environments (such as via direct <script> inclusion or bundling tools like Babel, Rollup, Vite, Next.js). Local, server, and command-line environments were not affected. The malicious package was removed from npm on the same day, and a clean patch version 1.3.4 was released to fix the issue. [1]
How can this vulnerability impact me? :
If you use the "error-ex" package in a browser environment, this vulnerability can redirect your cryptocurrency transactions to an attacker-controlled address, potentially causing financial loss. It specifically targets cryptocurrency wallets like MetaMask. Local, server, or command-line uses of the package are not affected. To mitigate the risk, users must update to version 1.3.4, remove node_modules, clear caches, and rebuild browser bundles. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection involves checking if the compromised version 1.3.3 of the 'error-ex' package is present in browser bundles or node_modules directories, especially if used in browser contexts. You can search for the package version in your project dependencies and inspect bundled scripts for suspicious code redirecting cryptocurrency transactions. Commands to help detect include: 1) Checking package version: `npm list error-ex` or `yarn list error-ex` 2) Searching for version 1.3.3 in lock files: `grep '[email protected]' package-lock.json yarn.lock` 3) Searching bundled browser scripts for suspicious code patterns related to cryptocurrency redirection (requires custom grep or scanning). 4) Verifying if node_modules contains version 1.3.3: `find node_modules/error-ex -type f` and inspecting files. Since the malware only activates in browser environments, monitoring network traffic for unexpected redirects to attacker cryptocurrency addresses in browser sessions may also help, but no specific commands are provided in the resources. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include: 1) Update the 'error-ex' package to version 1.3.4, which contains the fix. 2) Completely remove your node_modules directory to eliminate the compromised package: `rm -rf node_modules` 3) Clear your package manager's global cache to prevent reinstalling the malicious version: for npm, `npm cache clean --force`; for yarn, `yarn cache clean`. 4) Rebuild any browser bundles from scratch to ensure no malicious code remains in bundled scripts. 5) If you operate private registries or mirrors, purge the compromised version 1.3.3 from caches. These steps help ensure the malicious payload is removed and prevent further exploitation. [1]