CVE-2025-59142: color-string npm Package Malware XSS Attack

CVE-2025-59142 Overview

CVE-2025-59142 affects color-string, a widely used npm package that parses and generates CSS color strings. On 8 September 2025, attackers phished the maintainer's npm publishing account and published version 2.1.1 containing a malicious payload. The compromised release is functionally identical to the prior patch version but injects code that targets cryptocurrency transactions inside browser environments. The malware intercepts wallet activity, including MetaMask, and rewrites destination addresses to attacker-controlled wallets. Server-side, command-line, and local Node.js usage are not affected. npm removed the malicious version on 8 September, and the maintainer published 2.1.2 to remediate the issue.

Critical Impact
Bundled browser applications built against color-string@2.1.1 may silently redirect cryptocurrency transactions to attacker wallets and must be rebuilt against 2.1.2.

Affected Products

color-string npm package version 2.1.1
Browser bundles produced by Webpack, Rollup, Vite, Babel, Next.js, or similar tools that included color-string@2.1.1
Front-end applications that loaded color-string@2.1.1 via a direct <script> tag

Discovery Timeline

8 September 2025 - Maintainer's npm account compromised via phishing; malicious 2.1.1 published
8 September 2025 - npm removes the compromised package from the registry
13 September 2025 - Maintainer publishes 2.1.2 to cache-bust private registries holding the malicious version
2025-09-15 - CVE-2025-59142 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-59142

Vulnerability Analysis

The issue is classified as embedded malicious code [CWE-506]. The color-string package itself is not vulnerable in the traditional sense; rather, a specific published artifact, version 2.1.1, was trojanized after the maintainer's npm credentials were stolen through phishing. The injected payload activates only in browser execution contexts. It hooks Web3 provider interactions and wallet APIs exposed by extensions such as MetaMask, then rewrites transaction recipient addresses to attacker-controlled wallets before the user signs them. Because the swap occurs after the user reviews the original UI prompt, victims approve transactions believing the destination is legitimate.

Root Cause

The root cause is an account takeover of an npm maintainer rather than a coding defect. A phishing message harvested the publishing credentials, allowing the attacker to push a new patch release through the legitimate distribution channel. Downstream consumers received the malicious build through normal dependency resolution.

Attack Vector

The attack vector is the software supply chain. Any front-end application that resolved color-string@2.1.1, directly or transitively, and bundled it into browser-delivered JavaScript ships the malicious payload to end users. Server-side Node.js processes, CLI tools, and local builds that never reach a browser are not affected. Refer to the GitHub Security Advisory GHSA-286p-vc9p-p5qv and the Socket analysis of the qix maintainer compromise for payload details.

Detection Methods for CVE-2025-59142

Indicators of Compromise

Presence of color-string@2.1.1 in package-lock.json, yarn.lock, or pnpm-lock.yaml
Browser bundles containing string artifacts associated with the qix maintainer compromise payload documented by Socket and Aikido
Outbound requests from end-user browsers to wallet-draining infrastructure referenced in the Aikido write-up
Unexpected modifications to window.ethereum or other wallet provider objects at runtime

Detection Strategies

Run npm ls color-string across all projects to identify direct and transitive dependencies on the compromised version
Scan built artifacts (dist/, build/, CDN-published JS) for the malicious payload signatures published by Socket and Ox Security
Audit CI/CD logs for builds executed between 8 September 2025 and the upgrade to 2.1.2
Inspect content security policy (CSP) reports for unexpected script behavior tied to wallet interactions

Monitoring Recommendations

Monitor npm install and lockfile changes in source control for reintroduction of color-string@2.1.1
Alert on browser telemetry showing tampering with Web3 provider objects in production assets
Track private registry caches and proxy mirrors for retained copies of the malicious version

How to Mitigate CVE-2025-59142

Immediate Actions Required

Upgrade color-string to 2.1.2 or later across all projects and lockfiles
Rebuild and redeploy any browser bundle produced while 2.1.1 was resolvable
Invalidate CDN caches and service worker caches that may still serve the compromised JavaScript
Purge 2.1.1 from private npm registries, Verdaccio caches, and Artifactory proxies

Patch Information

The maintainer published color-string@2.1.2 on 13 September 2025 as the fixed release. The fixed version restores the legitimate source tree and removes the injected payload. See the GitHub Security Advisory GHSA-286p-vc9p-p5qv for the official remediation guidance and the Ox Security analysis for context on the broader compromise.

Workarounds

Pin color-string to a known-good prior version such as 2.1.0 if upgrading to 2.1.2 is not immediately feasible
Add an overrides (npm) or resolutions (Yarn/pnpm) entry to force the safe version across transitive dependencies
Enforce npm provenance checks and require signed publishes for high-risk dependencies
Block color-string@2.1.1 at the registry proxy layer to prevent reintroduction

bash

# Force a safe version across transitive dependencies (npm >= 8)
# package.json
{
  "overrides": {
    "color-string": "2.1.2"
  }
}

# Then rebuild lockfile and bundles
npm install
npm run build