CVE-2025-59141: simple-swizzle Malware XSS Vulnerability

CVE-2025-59141 Overview

CVE-2025-59141 affects the simple-swizzle npm package after a supply chain compromise. On 8 September 2025, attackers phished the maintainer's npm publishing account and published version 0.2.3. The release was functionally identical to the previous patch version but contained an embedded malware payload [CWE-506]. The payload targets browser environments and attempts to redirect cryptocurrency transactions to attacker-controlled addresses, including those processed through wallets such as MetaMask.

Critical Impact
Browser bundles that included the compromised simple-swizzle@0.2.3 may silently reroute cryptocurrency transactions to attacker wallets. Server-side, CLI, and local Node.js usage is not affected. The issue is resolved in 0.2.4.

Affected Products

simple-swizzle npm package version 0.2.3
Browser bundles built with Babel, Rollup, Vite, Next.js, or similar tooling that included the compromised version
Private npm registries or registry mirrors that cached the compromised tarball

Discovery Timeline

8 September 2025 - Malicious simple-swizzle@0.2.3 published to npm following a phishing-based account takeover
8 September 2025 - npm removes the offending package from the public registry
13 September 2025 - Maintainer publishes new patch versions to cache-bust private registries
15 September 2025 - CVE-2025-59141 published to NVD
15 April 2026 - Last updated in NVD database

Technical Details for CVE-2025-59141

Vulnerability Analysis

The compromised simple-swizzle@0.2.3 release embeds malicious JavaScript designed to execute in browser contexts. The payload hooks cryptocurrency transaction flows and substitutes the destination address before the user signs the transaction. Because the wallet UI still displays the user's intended address in some cases, the substitution can go unnoticed until funds are confirmed on-chain.

The package itself is a small utility consumed transitively by a large number of frontend dependencies. Any application that bundled simple-swizzle@0.2.3 into client-side JavaScript shipped the malware to end users. Pure server-side Node.js consumers and CLI tools are not affected because the payload only activates in browser environments where wallet provider objects such as window.ethereum exist.

Root Cause

The root cause is a phishing attack against the maintainer's npm account that allowed the attacker to publish a trojanized version to the public registry. This is classified under [CWE-506] Embedded Malicious Code. The package source on GitHub was not modified, so dependency review tools that compared only Git history would not detect the difference.

Attack Vector

Exploitation requires no interaction with the package maintainer or the victim application's build pipeline beyond a routine dependency install or update. Any npm install or yarn install that resolved simple-swizzle to 0.2.3 pulled the malicious code. Once bundled, the malware runs in the browser of every visitor to the affected web application and intercepts wallet operations.

The malicious payload is documented in the GitHub Security Advisory GHSA-9g9j-rggx-7fmg and analyzed in detail by Socket, Aikido, and Ox Security.

Detection Methods for CVE-2025-59141

Indicators of Compromise

Presence of simple-swizzle version 0.2.3 in package-lock.json, yarn.lock, or pnpm-lock.yaml
Browser bundles built between 8 September and 13 September 2025 that include transitive dependencies on simple-swizzle
Outbound requests from client browsers to attacker-controlled cryptocurrency addresses or unfamiliar endpoints during wallet interactions
Cached 0.2.3 tarball artifacts in private npm registries, Verdaccio, JFrog Artifactory, or Sonatype Nexus mirrors

Detection Strategies

Run npm ls simple-swizzle and npm why simple-swizzle across all frontend projects to identify resolved versions
Scan build artifacts and CDN-hosted JavaScript bundles for the malicious payload signatures published in the GHSA advisory
Audit Software Bill of Materials (SBOM) data for any reference to simple-swizzle@0.2.3
Review CI/CD logs from 8–13 September 2025 for builds that may have pulled the compromised version

Monitoring Recommendations

Enable npm provenance and signed-package verification in CI pipelines
Subscribe to GitHub Security Advisories and OSV feeds for direct and transitive dependencies
Alert on user reports of unexpected wallet behavior or transaction redirection on production web properties
Continuously inventory third-party JavaScript loaded by production frontends and flag changes

How to Mitigate CVE-2025-59141

Immediate Actions Required

Upgrade simple-swizzle to 0.2.4 or later across all projects
Delete node_modules directories and lockfiles, then reinstall to ensure no cached 0.2.3 artifacts remain
Clear the global package manager cache with npm cache clean --force, yarn cache clean, or pnpm store prune
Rebuild and redeploy any browser bundles produced between 8 September and 13 September 2025
Purge simple-swizzle@0.2.3 from private registries and registry mirrors

Patch Information

The maintainer resolved the issue in simple-swizzle@0.2.4, published on 13 September 2025. This version is functionally equivalent to the prior clean release and was issued specifically to invalidate cached copies of the compromised tarball. Details are available in the GitHub Security Advisory and related debug-js issue thread.

Workarounds

Pin simple-swizzle to a known-good version such as 0.2.2 or >=0.2.4 in package.json and regenerate the lockfile
Use npm overrides, yarn resolutions, or pnpm.overrides to force a clean version across transitive dependencies
Apply a Content Security Policy that restricts outbound network requests from production frontends to expected origins only
Until rebuilds complete, place a temporary banner advising users to verify wallet transaction destination addresses before signing

bash

# Force a clean simple-swizzle version across transitive dependencies
# package.json
{
  "overrides": {
    "simple-swizzle": ">=0.2.4"
  }
}

# Then refresh the dependency tree
rm -rf node_modules package-lock.json
npm cache clean --force
npm install
npm ls simple-swizzle