Vulnerability-Lookup

CVE-2025-59145 (GCVE-0-2025-59145)

Vulnerability from cvelistv5 – Published: 2025-09-15 20:32 – Updated: 2025-09-15 20:39

Title

color-name@2.0.1 contains malware after npm account takeover

Summary

color-name is a JSON with CSS color names. On 8 September 2025, an npm publishing account for color-name was taken over after a phishing attack. Version 2.0.1 was published, functionally identical to the previous patch version, but with a malware payload added attempting to redirect cryptocurrency transactions to the attacker's own addresses from within browser environments. Local environments, server environments, command line applications, etc. are not affected. If the package was used in a browser context (e.g. a direct <script> inclusion, or via a bundling tool such as Babel, Rollup, Vite, Next.js, etc.) there is a chance the malware still exists and such bundles will need to be rebuilt. The malware seemingly only targets cryptocurrency transactions and wallets such as MetaMask. See references below for more information on the payload. npm removed the offending package from the registry over the course of the day on 8 September, preventing further downloads from npm proper. On 13 September, the package owner published new patch versions to help cache-bust those using private registries who might still have the compromised version cached. Users should update to the latest patch version, completely remove their node_modules directory, clean their package manager's global cache, and rebuild any browser bundles from scratch. Those operating private registries or registry mirrors should purge the offending versions from any caches. This issue is resolved in 2.0.2.

Severity

8.8 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:A/U:Red

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-09-15 20:39 UTC

CWE

CWE-506 - Embedded Malicious Code

Assigner

GitHub_M mitre root Scorecard

References

5 references

URL	Tags
https://github.com/colorjs/color-name/security/ad…	x_refsource_CONFIRM
https://github.com/debug-js/debug/issues/1005	x_refsource_MISC
https://socket.dev/blog/npm-author-qix-compromise…	x_refsource_MISC
https://www.aikido.dev/blog/npm-debug-and-chalk-p…	x_refsource_MISC
https://www.ox.security/blog/npm-packages-compromised	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
colorjs	color-name	Affected: = 2.0.1	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-59145",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-15T20:39:50.044627Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-09-15T20:39:58.389Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "color-name",
          "vendor": "colorjs",
          "versions": [
            {
              "status": "affected",
              "version": "= 2.0.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "color-name is a JSON with CSS color names. On 8 September 2025, an npm publishing account for color-name was taken over after a phishing attack. Version 2.0.1 was published, functionally identical to the previous patch version, but with a malware payload added attempting to redirect cryptocurrency transactions to the attacker\u0027s own addresses from within browser environments. Local environments, server environments, command line applications, etc. are not affected. If the package was used in a browser context (e.g. a direct \u003cscript\u003e inclusion, or via a bundling tool such as Babel, Rollup, Vite, Next.js, etc.) there is a chance the malware still exists and such bundles will need to be rebuilt. The malware seemingly only targets cryptocurrency transactions and wallets such as MetaMask. See references below for more information on the payload. npm removed the offending package from the registry over the course of the day on 8 September, preventing further downloads from npm proper. On 13 September, the package owner published new patch versions to help cache-bust those using private registries who might still have the compromised version cached. Users should update to the latest patch version, completely remove their node_modules directory, clean their package manager\u0027s global cache, and rebuild any browser bundles from scratch. Those operating private registries or registry mirrors should purge the offending versions from any caches. This issue is resolved in 2.0.2."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:A/U:Red",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-506",
              "description": "CWE-506: Embedded Malicious Code",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-15T20:32:43.877Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/colorjs/color-name/security/advisories/GHSA-5fvm-p68v-5wmh",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/colorjs/color-name/security/advisories/GHSA-5fvm-p68v-5wmh"
        },
        {
          "name": "https://github.com/debug-js/debug/issues/1005",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/debug-js/debug/issues/1005"
        },
        {
          "name": "https://socket.dev/blog/npm-author-qix-compromised-in-major-supply-chain-attack",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://socket.dev/blog/npm-author-qix-compromised-in-major-supply-chain-attack"
        },
        {
          "name": "https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised"
        },
        {
          "name": "https://www.ox.security/blog/npm-packages-compromised",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.ox.security/blog/npm-packages-compromised"
        }
      ],
      "source": {
        "advisory": "GHSA-5fvm-p68v-5wmh",
        "discovery": "UNKNOWN"
      },
      "title": "color-name@2.0.1 contains malware after npm account takeover"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-59145",
    "datePublished": "2025-09-15T20:32:43.877Z",
    "dateReserved": "2025-09-09T15:23:16.326Z",
    "dateUpdated": "2025-09-15T20:39:58.389Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-59145",
      "date": "2026-10-05",
      "epss": "0.00554",
      "percentile": "0.44327"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "color-name",
                "vendor": "colorjs",
                "versions": [
                  {
                    "status": "affected",
                    "version": "= 2.0.1"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "color-name is a JSON with CSS color names. On 8 September 2025, an npm publishing account for color-name was taken over after a phishing attack. Version 2.0.1 was published, functionally identical to the previous patch version, but with a malware payload added attempting to redirect cryptocurrency transactions to the attacker\u0027s own addresses from within browser environments. Local environments, server environments, command line applications, etc. are not affected. If the package was used in a browser context (e.g. a direct \u003cscript\u003e inclusion, or via a bundling tool such as Babel, Rollup, Vite, Next.js, etc.) there is a chance the malware still exists and such bundles will need to be rebuilt. The malware seemingly only targets cryptocurrency transactions and wallets such as MetaMask. See references below for more information on the payload. npm removed the offending package from the registry over the course of the day on 8 September, preventing further downloads from npm proper. On 13 September, the package owner published new patch versions to help cache-bust those using private registries who might still have the compromised version cached. Users should update to the latest patch version, completely remove their node_modules directory, clean their package manager\u0027s global cache, and rebuild any browser bundles from scratch. Those operating private registries or registry mirrors should purge the offending versions from any caches. This issue is resolved in 2.0.2."
          },
          {
            "lang": "es",
            "value": "color-name es un JSON con nombres de colores CSS. El 8 de septiembre de 2025, una cuenta de publicaci\u00f3n de npm para color-name fue tomada despu\u00e9s de un ataque de phishing. La versi\u00f3n 2.0.1 fue publicada, funcionalmente id\u00e9ntica a la versi\u00f3n de parche anterior, pero con una carga \u00fatil de malware a\u00f1adida que intentaba redirigir transacciones de criptomonedas a las propias direcciones del atacante desde entornos de navegador. Entornos locales, entornos de servidor, aplicaciones de l\u00ednea de comandos, etc. no est\u00e1n afectados. Si el paquete fue utilizado en un contexto de navegador (p. ej., una inclusi\u00f3n directa de \u003cscript\u003e, o a trav\u00e9s de una herramienta de empaquetado como Babel, Rollup, Vite, Next.js, etc.) existe la posibilidad de que el malware a\u00fan exista y dichos paquetes deber\u00e1n ser reconstruidos. El malware aparentemente solo apunta a transacciones de criptomonedas y billeteras como MetaMask. Consulte las referencias a continuaci\u00f3n para obtener m\u00e1s informaci\u00f3n sobre la carga \u00fatil. npm elimin\u00f3 el paquete ofensivo del registro a lo largo del d\u00eda del 8 de septiembre, evitando descargas adicionales desde npm propiamente dicho. El 13 de septiembre, el propietario del paquete public\u00f3 nuevas versiones de parche para ayudar a invalidar la cach\u00e9 de aquellos que usan registros privados y que a\u00fan podr\u00edan tener la versi\u00f3n comprometida en cach\u00e9. Los usuarios deben actualizar a la \u00faltima versi\u00f3n de parche, eliminar completamente su directorio node_modules, limpiar la cach\u00e9 global de su gestor de paquetes y reconstruir cualquier paquete de navegador desde cero. Aquellos que operan registros privados o espejos de registro deben purgar las versiones ofensivas de cualquier cach\u00e9. Este problema se resuelve en 2.0.2."
          }
        ],
        "id": "CVE-2025-59145",
        "lastModified": "2026-09-30T23:10:00.237",
        "metrics": {
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "ATTACKED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "RED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Red",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "LOW",
                "vulnIntegrityImpact": "HIGH",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2025-59145",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-15T20:39:50.044627Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2025-09-15T21:15:36.633",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/colorjs/color-name/security/advisories/GHSA-5fvm-p68v-5wmh"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/debug-js/debug/issues/1005"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://socket.dev/blog/npm-author-qix-compromised-in-major-supply-chain-attack"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://www.ox.security/blog/npm-packages-compromised"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-506"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-06-30T00:30:20+00:00",
      "cve": "CVE-2025-59145",
      "id": "CVE-2025-59145",
      "initial_release_date": "2025-09-15T20:32:43.877000+00:00",
      "product_status:known_not_affected": "493",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "color-name: color-name@2.0.1 contains malware after npm account takeover",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-59145.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2025-59145",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-09-15T20:39:50.044627Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-09-15T20:39:55.376Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "color-name",
              "vendor": "colorjs",
              "versions": [
                {
                  "status": "affected",
                  "version": "= 2.0.1"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "color-name is a JSON with CSS color names. On 8 September 2025, an npm publishing account for color-name was taken over after a phishing attack. Version 2.0.1 was published, functionally identical to the previous patch version, but with a malware payload added attempting to redirect cryptocurrency transactions to the attacker\u0027s own addresses from within browser environments. Local environments, server environments, command line applications, etc. are not affected. If the package was used in a browser context (e.g. a direct \u003cscript\u003e inclusion, or via a bundling tool such as Babel, Rollup, Vite, Next.js, etc.) there is a chance the malware still exists and such bundles will need to be rebuilt. The malware seemingly only targets cryptocurrency transactions and wallets such as MetaMask. See references below for more information on the payload. npm removed the offending package from the registry over the course of the day on 8 September, preventing further downloads from npm proper. On 13 September, the package owner published new patch versions to help cache-bust those using private registries who might still have the compromised version cached. Users should update to the latest patch version, completely remove their node_modules directory, clean their package manager\u0027s global cache, and rebuild any browser bundles from scratch. Those operating private registries or registry mirrors should purge the offending versions from any caches. This issue is resolved in 2.0.2."
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "privilegesRequired": "NONE",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:A/U:Red",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "LOW",
                "vulnIntegrityImpact": "HIGH"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-506",
                  "description": "CWE-506: Embedded Malicious Code",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2025-09-15T20:32:43.877Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/colorjs/color-name/security/advisories/GHSA-5fvm-p68v-5wmh",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/colorjs/color-name/security/advisories/GHSA-5fvm-p68v-5wmh"
            },
            {
              "name": "https://github.com/debug-js/debug/issues/1005",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/debug-js/debug/issues/1005"
            },
            {
              "name": "https://socket.dev/blog/npm-author-qix-compromised-in-major-supply-chain-attack",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://socket.dev/blog/npm-author-qix-compromised-in-major-supply-chain-attack"
            },
            {
              "name": "https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised"
            },
            {
              "name": "https://www.ox.security/blog/npm-packages-compromised",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://www.ox.security/blog/npm-packages-compromised"
            }
          ],
          "source": {
            "advisory": "GHSA-5fvm-p68v-5wmh",
            "discovery": "UNKNOWN"
          },
          "title": "color-name@2.0.1 contains malware after npm account takeover"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2025-59145",
        "datePublished": "2025-09-15T20:32:43.877Z",
        "dateReserved": "2025-09-09T15:23:16.326Z",
        "dateUpdated": "2025-09-15T20:39:58.389Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

BDU:2026-07577 (CVE-2025-59145)

Vulnerability from fstec – Published: 2026-06-01 – Updated: 2026-06-01 – View on bdu.fstec.ru Exploit publicly available Yes Fixed

Title

Уязвимость npm-библиотеки Color-Name, связанная с наличием недекларированных возможностей, позволяющая нарушителю выполнить произвольный код

Summary

Уязвимость npm-библиотеки Color-Name связана с наличием недекларированных возможностей. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, выполнить произвольный код

Severity

8.5 (High) CVSS 2.0


                      
                        AV:N/AC:L/Au:N/C:P/I:C/A:N

8.2 (High) CVSS 3.1


                      
                        CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

8.8 (High) CVSS 4.0


                      
                        CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:A/U:Red

Class

Code vulnerability

Status

Confirmed by the vendor

Exploitation

Functionality abuse

Incidents

Yes

Remediation

Software update

CWE

CWE-506 - Внедренный вредоносный код

Aliases

CVE-2025-59145, GHSA-5FVM-P68V-5WMH

References

6 references

URL
https://github.com/colorjs/color-name/security/advisories/GHSA-5fvm-p68v-5wmh
https://github.com/debug-js/debug/issues/1005
https://socket.dev/blog/npm-author-qix-compromised-in-major-supply-chain-attack
https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised
https://www.ox.security/blog/npm-packages-compromised
https://vulners.com/cve/CVE-2025-59145

Impacted products

1 product from 1 vendor

Vendors

Сообщество свободного программного обеспечения

Products

Color-Name

Versions

до 2.0.2 (Color-Name)

Product types

Application software

Mitigations

Использование рекомендаций производителя: https://github.com/colorjs/color-name/security/advisories/GHSA-5fvm-p68v-5wmh https://github.com/debug-js/debug/issues/1005

JSON

To clipboard

{
  "CVSS 2.0": "AV:N/AC:L/Au:N/C:P/I:C/A:N",
  "CVSS 3.0": "AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N",
  "CVSS 4.0": "AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:A/U:Red",
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "\u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "\u0434\u043e 2.0.2 (Color-Name)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f:\nhttps://github.com/colorjs/color-name/security/advisories/GHSA-5fvm-p68v-5wmh\nhttps://github.com/debug-js/debug/issues/1005",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "08.09.2025",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "01.06.2026",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "01.06.2026",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2026-07577",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2025-59145, GHSA-5fvm-p68v-5wmh",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "Color-Name",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": null,
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c npm-\u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 Color-Name, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 \u043d\u0430\u043b\u0438\u0447\u0438\u0435\u043c \u043d\u0435\u0434\u0435\u043a\u043b\u0430\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0435\u0439, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0421\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u0435",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u0412\u043d\u0435\u0434\u0440\u0435\u043d\u043d\u044b\u0439 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434 (CWE-506)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c npm-\u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 Color-Name \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0430\u043b\u0438\u0447\u0438\u0435\u043c \u043d\u0435\u0434\u0435\u043a\u043b\u0430\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0435\u0439. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u0417\u043b\u043e\u0443\u043f\u043e\u0442\u0440\u0435\u0431\u043b\u0435\u043d\u0438\u0435 \u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0430\u043b\u043e\u043c",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://github.com/colorjs/color-name/security/advisories/GHSA-5fvm-p68v-5wmh\nhttps://github.com/debug-js/debug/issues/1005\nhttps://socket.dev/blog/npm-author-qix-compromised-in-major-supply-chain-attack\nhttps://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised\nhttps://www.ox.security/blog/npm-packages-compromised\nhttps://vulners.com/cve/CVE-2025-59145",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041f\u0440\u0438\u043a\u043b\u0430\u0434\u043d\u043e\u0435 \u041f\u041e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-506",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 8,5)\n\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.1 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 8,2)\n\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u043e\u0446\u0435\u043d\u043a\u0430 CVSS 4.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 8,8)"
}

FKIE_CVE-2025-59145

Vulnerability from fkie_nvd - Published: 2025-09-15 21:15 - Updated: 2026-09-30 23:10

Severity

8.8 (High) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:A/U:Red

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/colorjs/color-name/security/advisories/GHSA-5fvm-p68v-5wmh
	security-advisories@github.com	https://github.com/debug-js/debug/issues/1005
	security-advisories@github.com	https://socket.dev/blog/npm-author-qix-compromised-in-major-supply-chain-attack
	security-advisories@github.com	https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised
	security-advisories@github.com	https://www.ox.security/blog/npm-packages-compromised

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "color-name",
          "vendor": "colorjs",
          "versions": [
            {
              "status": "affected",
              "version": "= 2.0.1"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "color-name is a JSON with CSS color names. On 8 September 2025, an npm publishing account for color-name was taken over after a phishing attack. Version 2.0.1 was published, functionally identical to the previous patch version, but with a malware payload added attempting to redirect cryptocurrency transactions to the attacker\u0027s own addresses from within browser environments. Local environments, server environments, command line applications, etc. are not affected. If the package was used in a browser context (e.g. a direct \u003cscript\u003e inclusion, or via a bundling tool such as Babel, Rollup, Vite, Next.js, etc.) there is a chance the malware still exists and such bundles will need to be rebuilt. The malware seemingly only targets cryptocurrency transactions and wallets such as MetaMask. See references below for more information on the payload. npm removed the offending package from the registry over the course of the day on 8 September, preventing further downloads from npm proper. On 13 September, the package owner published new patch versions to help cache-bust those using private registries who might still have the compromised version cached. Users should update to the latest patch version, completely remove their node_modules directory, clean their package manager\u0027s global cache, and rebuild any browser bundles from scratch. Those operating private registries or registry mirrors should purge the offending versions from any caches. This issue is resolved in 2.0.2."
    },
    {
      "lang": "es",
      "value": "color-name es un JSON con nombres de colores CSS. El 8 de septiembre de 2025, una cuenta de publicaci\u00f3n de npm para color-name fue tomada despu\u00e9s de un ataque de phishing. La versi\u00f3n 2.0.1 fue publicada, funcionalmente id\u00e9ntica a la versi\u00f3n de parche anterior, pero con una carga \u00fatil de malware a\u00f1adida que intentaba redirigir transacciones de criptomonedas a las propias direcciones del atacante desde entornos de navegador. Entornos locales, entornos de servidor, aplicaciones de l\u00ednea de comandos, etc. no est\u00e1n afectados. Si el paquete fue utilizado en un contexto de navegador (p. ej., una inclusi\u00f3n directa de \u003cscript\u003e, o a trav\u00e9s de una herramienta de empaquetado como Babel, Rollup, Vite, Next.js, etc.) existe la posibilidad de que el malware a\u00fan exista y dichos paquetes deber\u00e1n ser reconstruidos. El malware aparentemente solo apunta a transacciones de criptomonedas y billeteras como MetaMask. Consulte las referencias a continuaci\u00f3n para obtener m\u00e1s informaci\u00f3n sobre la carga \u00fatil. npm elimin\u00f3 el paquete ofensivo del registro a lo largo del d\u00eda del 8 de septiembre, evitando descargas adicionales desde npm propiamente dicho. El 13 de septiembre, el propietario del paquete public\u00f3 nuevas versiones de parche para ayudar a invalidar la cach\u00e9 de aquellos que usan registros privados y que a\u00fan podr\u00edan tener la versi\u00f3n comprometida en cach\u00e9. Los usuarios deben actualizar a la \u00faltima versi\u00f3n de parche, eliminar completamente su directorio node_modules, limpiar la cach\u00e9 global de su gestor de paquetes y reconstruir cualquier paquete de navegador desde cero. Aquellos que operan registros privados o espejos de registro deben purgar las versiones ofensivas de cualquier cach\u00e9. Este problema se resuelve en 2.0.2."
    }
  ],
  "id": "CVE-2025-59145",
  "lastModified": "2026-09-30T23:10:00.237",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "ATTACKED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "RED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Red",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "LOW",
          "vulnIntegrityImpact": "HIGH",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-59145",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-09-15T20:39:50.044627Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2025-09-15T21:15:36.633",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/colorjs/color-name/security/advisories/GHSA-5fvm-p68v-5wmh"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/debug-js/debug/issues/1005"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://socket.dev/blog/npm-author-qix-compromised-in-major-supply-chain-attack"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://www.ox.security/blog/npm-packages-compromised"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-506"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-5FVM-P68V-5WMH

Vulnerability from github – Published: 2025-09-15 22:03 – Updated: 2025-09-15 22:03

Summary

color-name@2.0.1 contains malware after npm account takeover

Details

Impact

On 8 September 2025, an npm publishing account for color-name was taken over after a phishing attack. Version 2.0.1 was published, functionally identical to the previous patch version, but with a malware payload added attempting to redirect cryptocurrency transactions to the attacker's own addresses from within browser environments.

Local environments, server environments, command line applications, etc. are not affected. If the package was used in a browser context (e.g. a direct <script> inclusion, or via a bundling tool such as Babel, Rollup, Vite, Next.js, etc.) there is a chance the malware still exists and such bundles will need to be rebuilt.

The malware seemingly only targets cryptocurrency transactions and wallets such as MetaMask. See references below for more information on the payload.

Patches

npm removed the offending package from the registry over the course of the day on 8 September, preventing further downloads from npm proper.

On 13 September, the package owner published new patch versions to help cache-bust those using private registries who might still have the compromised version cached. This version is functionally identical to the previously known-good version, published as a patch version bump above the compromised version.

Users should update to the latest patch version, completely remove their node_modules directory, clean their package manager's global cache, and rebuild any browser bundles from scratch.

Those operating private registries or registry mirrors should purge the offending versions from any caches.

Resources

https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised
https://socket.dev/blog/npm-author-qix-compromised-in-major-supply-chain-attack
https://www.ox.security/blog/npm-packages-compromised/

Point of Contact

In the event suspicious behavior is still observed for the package listed in this security advisory after performing all of the above cleaning operations (see Patches above), please reach out via one of the following channels of communication:

Bluesky, compromised publishing account owner: https://bsky.app/profile/bad-at-computer.bsky.social
debug repository, tracking issue (applies to all packages affected in the breach): https://github.com/debug-js/debug/issues/1005

Severity

8.8 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:A/U:Red

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "color-name"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.0.1"
            },
            {
              "fixed": "2.0.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.0.1"
      ]
    }
  ],
  "aliases": [
    "CVE-2025-59145"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-506"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-09-15T22:03:28Z",
    "nvd_published_at": "2025-09-15T21:15:36Z",
    "severity": "HIGH"
  },
  "details": "### Impact\nOn 8 September 2025, an npm publishing account for `color-name` was taken over after a phishing attack. Version `2.0.1` was published, functionally identical to the previous patch version, but with a malware payload added attempting to redirect cryptocurrency transactions to the attacker\u0027s own addresses from within browser environments.\n\nLocal environments, server environments, command line applications, etc. are not affected. If the package was used in a browser context (e.g. a direct `\u003cscript\u003e` inclusion, or via a bundling tool such as Babel, Rollup, Vite, Next.js, etc.) there is a chance the malware still exists and such bundles will need to be rebuilt.\n\nThe malware seemingly only targets cryptocurrency transactions and wallets such as MetaMask. See references below for more information on the payload.\n\n### Patches\nnpm removed the offending package from the registry over the course of the day on 8 September, preventing further downloads from npm proper.\n\nOn 13 September, the package owner published new patch versions to help cache-bust those using private registries who might still have the compromised version cached. This version is functionally identical to the previously known-good version, published as a patch version bump above the compromised version.\n\nUsers should update to the latest patch version, completely remove their `node_modules` directory, clean their package manager\u0027s global cache, and rebuild any browser bundles from scratch.\n\nThose operating private registries or registry mirrors should purge the offending versions from any caches.\n\n### Resources\n- https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised\n- https://socket.dev/blog/npm-author-qix-compromised-in-major-supply-chain-attack\n- https://www.ox.security/blog/npm-packages-compromised/\n\n### Point of Contact\nIn the event suspicious behavior is still observed for the package listed in this security advisory after performing all of the above cleaning operations (see _Patches_ above), please reach out via one of the following channels of communication:\n\n- Bluesky, compromised publishing account owner: https://bsky.app/profile/bad-at-computer.bsky.social\n- `debug` repository, tracking issue (applies to all packages affected in the breach): https://github.com/debug-js/debug/issues/1005",
  "id": "GHSA-5fvm-p68v-5wmh",
  "modified": "2025-09-15T22:03:28Z",
  "published": "2025-09-15T22:03:28Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/colorjs/color-name/security/advisories/GHSA-5fvm-p68v-5wmh"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59145"
    },
    {
      "type": "WEB",
      "url": "https://github.com/debug-js/debug/issues/1005"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/colorjs/color-name"
    },
    {
      "type": "WEB",
      "url": "https://socket.dev/blog/npm-author-qix-compromised-in-major-supply-chain-attack"
    },
    {
      "type": "WEB",
      "url": "https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised"
    },
    {
      "type": "WEB",
      "url": "https://www.ox.security/blog/npm-packages-compromised"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:A/U:Red",
      "type": "CVSS_V4"
    }
  ],
  "summary": "color-name@2.0.1 contains malware after npm account takeover"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2025-59145 (GCVE-0-2025-59145)

BDU:2026-07577 (CVE-2025-59145)

FKIE_CVE-2025-59145

GHSA-5FVM-P68V-5WMH

Impact

Patches

Resources

Point of Contact

Tags

Sightings

Nomenclature

Related by attack behaviour