CVE-2025-59140: Backslash npm Package Malware Vulnerability

CVE-2025-59140 Overview

CVE-2025-59140 documents a supply chain compromise of the backslash npm package. On 8 September 2025, attackers used a phishing campaign to take over the maintainer's npm publishing account. They published version 0.2.1, which was functionally identical to the prior release but contained a malicious payload targeting cryptocurrency wallets in browser environments. The injected code attempts to redirect transactions to attacker-controlled wallet addresses, including those used by MetaMask. Server-side, command-line, and local Node.js consumers are not affected. npm removed the malicious version on the same day, and the maintainer published 0.2.2 on 13 September 2025 to invalidate cached copies on private registries.

Critical Impact
Any browser bundle built with backslash@0.2.1 may silently hijack cryptocurrency transactions and exfiltrate wallet interactions to attacker-controlled addresses.

Affected Products

backslash npm package version 0.2.1
Browser bundles produced with Webpack, Rollup, Vite, Next.js, Babel, or similar tooling that included 0.2.1
Private npm registries or mirrors that cached version 0.2.1

Discovery Timeline

2025-09-08 - Maintainer npm account compromised via phishing; malicious 0.2.1 published and later removed by npm
2025-09-13 - Maintainer publishes 0.2.2 to cache-bust private registries
2025-09-15 - CVE-2025-59140 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-59140

Vulnerability Analysis

The vulnerability is classified under [CWE-506] Embedded Malicious Code. The attacker did not exploit a coding flaw in backslash itself. Instead, they hijacked the maintainer's publishing credentials and pushed a tampered release through legitimate npm distribution channels. The injected payload activates only when the package is loaded inside a browser context. It hooks into JavaScript APIs used by Ethereum and other wallet providers and rewrites destination addresses before the user signs a transaction. Because the source on GitHub remained clean, the compromise was invisible to developers who reviewed the repository rather than the published tarball.

Root Cause

The root cause is account takeover of an npm maintainer through a phishing attack, combined with the absence of mandatory two-factor publishing controls at the time. The npm registry trusts authenticated publishers, so a hijacked token is sufficient to ship arbitrary code to every downstream consumer. Lockfile pinning and integrity hashes only protect installs performed before the malicious version is published; new installs and CI rebuilds happily fetch the compromised tarball.

Attack Vector

Delivery is transitive. Developers who install backslash directly, or any package that depends on it, receive the trojanized version during npm install. When the resulting bundle ships to a browser, the malware inspects window.ethereum and similar wallet bridges. It intercepts calls such as eth_sendTransaction and personal_sign, swapping the recipient or approval target with an attacker address. The user sees the spoofed transaction in their wallet UI and signs it, transferring funds to the attacker. No exploit code is reproduced here; see the GitHub Security Advisory and the Socket.dev analysis for forensic details.

Detection Methods for CVE-2025-59140

Indicators of Compromise

Presence of backslash@0.2.1 in package-lock.json, yarn.lock, or pnpm-lock.yaml
Outbound DNS or HTTPS traffic from browsers to wallet-draining infrastructure documented in the Aikido.dev write-up and Ox Security blog
Bundled JavaScript artifacts containing obfuscated hooks against window.ethereum, eth_sendTransaction, or personal_sign that are not present in the upstream backslash source
Build logs showing installation of backslash version 0.2.1 between 8 September and 13 September 2025

Detection Strategies

Run npm ls backslash and npm audit across all repositories and CI caches to flag version 0.2.1
Diff published tarball contents against the GitHub source tag to surface code that exists only in the registry artifact
Use Software Composition Analysis (SCA) tools that consume the GitHub Advisory Database to alert on GHSA-53mq-f4w3-f7qv
Inspect deployed browser bundles for strings related to wallet hooking and base58 or hex address substitution patterns

Monitoring Recommendations

Continuously ingest npm advisory feeds and the GitHub Advisory Database into the SIEM
Alert on any new release of pinned dependencies that arrives outside an expected change window
Monitor egress from end-user browsers and CI runners for connections to known wallet-drainer domains
Track Web3 transaction anomalies such as approvals to previously unseen contract addresses

How to Mitigate CVE-2025-59140

Immediate Actions Required

Upgrade backslash to version 0.2.2 or later across all projects and lockfiles
Delete node_modules and reinstall dependencies from a clean state
Purge the global package manager cache with npm cache clean --force, yarn cache clean, or pnpm store prune
Rebuild and redeploy every browser bundle produced while 0.2.1 was resolvable
Rotate any wallet keys or session tokens that may have interacted with a compromised bundle

Patch Information

The issue is resolved in backslash@0.2.2, published on 13 September 2025. The maintainer released this version specifically to cache-bust private registries and mirrors that may still serve the malicious 0.2.1. Refer to the GitHub Security Advisory GHSA-53mq-f4w3-f7qv for the authoritative remediation guidance.

Workarounds

Operators of private npm registries must purge backslash@0.2.1 from caches and mirror storage
Pin backslash to >=0.2.2 in package.json and regenerate lockfiles to prevent resolution drift
Block version 0.2.1 at the registry proxy or SCA policy layer for defense in depth
For applications that cannot redeploy immediately, disable Web3 wallet features until a clean bundle is shipped

bash

# Configuration example
npm install backslash@^0.2.2
rm -rf node_modules
npm cache clean --force
npm ci
npm run build