CVE-2025-59143: color Library Malware Injection Vulnerability

CVE-2025-59143 Overview

CVE-2025-59143 affects the color npm package, a widely used JavaScript color conversion and manipulation library. On 8 September 2025, attackers phished the maintainer's npm publishing account and published a malicious version 5.0.1. The release was functionally identical to the prior patch version but contained a malware payload that intercepts cryptocurrency transactions in browser environments. The payload targets wallets such as MetaMask and redirects funds to attacker-controlled addresses. Server-side, CLI, and local Node.js usage are not affected. The maintainer published 5.0.2 on 13 September 2025 to bust caches in private registries that may still hold the compromised build.

Critical Impact
Browser bundles built with the malicious color@5.0.1 package silently rewrite cryptocurrency wallet destinations, redirecting user funds to attacker-controlled addresses.

Affected Products

color npm package version 5.0.1
Any browser bundles built via Babel, Rollup, Vite, Next.js, or similar tooling that included color@5.0.1
Private npm registries or mirrors that cached the compromised version

Discovery Timeline

8 September 2025 - Malicious color@5.0.1 published to npm following maintainer account phishing; npm removes the package later that day
13 September 2025 - Maintainer publishes clean patch versions to cache-bust private registries
2025-09-15 - CVE-2025-59143 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-59143

Vulnerability Analysis

This is a software supply chain compromise classified as embedded malicious code [CWE-506]. The attacker obtained publish rights to the color package by phishing the maintainer's npm credentials, then released 5.0.1 containing a hidden cryptocurrency-stealing payload. Because color is a transitive dependency in many JavaScript build graphs, the malicious code propagated into downstream browser bundles without developer awareness. The payload activates only in browser contexts, hooks into wallet provider APIs such as MetaMask, and rewrites transaction recipient addresses before signing. Server-side Node.js execution paths do not trigger the payload, which helped the malicious build evade casual review.

Root Cause

The root cause is not a code defect in color itself but a compromise of the npm publishing account through credential phishing. The integrity of the npm distribution channel for this package was broken for the duration that 5.0.1 remained published and cached.

Attack Vector

Attackers delivered the payload through the npm registry as a routine-looking patch release. Developers who ran npm install or npm update between publication and removal pulled the malicious tarball. Build tools then embedded the payload into production JavaScript bundles shipped to end users. The payload executes in the victim's browser, monitors window.ethereum and related wallet objects, and substitutes attacker-controlled destination addresses during cryptocurrency transactions. The vulnerability description does not include exploitation code; refer to the GitHub Security Advisory and the Socket analysis of the supply chain attack for payload specifics.

Detection Methods for CVE-2025-59143

Indicators of Compromise

Presence of color@5.0.1 in package-lock.json, yarn.lock, pnpm-lock.yaml, or any private registry cache
Production JavaScript bundles built between 8 September 2025 and the rebuild date that included color as a direct or transitive dependency
Outbound network requests from browser sessions to attacker-controlled wallet addresses or unfamiliar domains following wallet interaction
Wallet transaction history showing recipient addresses that differ from the address the user intended to send to

Detection Strategies

Run npm ls color or pnpm why color across all JavaScript projects to enumerate use of the affected version
Scan CI/CD artifact stores and CDN-hosted bundles for the string signatures referenced in the Socket blog and Aikido analysis
Audit private registry caches (Verdaccio, Nexus, Artifactory) for stored copies of color-5.0.1.tgz

Monitoring Recommendations

Monitor Software Composition Analysis (SCA) tooling for advisory GHSA-qrmh-qg46-72pp matches in current and historical builds
Alert on any new dependency version published within hours of release that lands in production builds without code review
Log and review browser-side network egress from finance and crypto-related web applications for unexpected destinations

How to Mitigate CVE-2025-59143

Immediate Actions Required

Upgrade color to 5.0.2 or later across all projects and lockfiles
Delete node_modules entirely and clear the package manager cache using npm cache clean --force, yarn cache clean, or pnpm store prune
Rebuild and redeploy every browser bundle that depended on color, directly or transitively, since 8 September 2025
Purge color@5.0.1 from any private registry, mirror, or artifact cache to prevent reinstallation
Rotate any npm publishing tokens and enforce phishing-resistant multi-factor authentication on maintainer accounts

Patch Information

The issue is resolved in color version 5.0.2. The maintainer published this version on 13 September 2025 specifically to invalidate cached copies of the compromised release in private registries. See the GitHub Security Advisory GHSA-qrmh-qg46-72pp for full details.

Workarounds

Pin color to a known-good version prior to 5.0.1 if upgrading to 5.0.2 is temporarily blocked
Restrict end-user wallet interactions in affected applications until bundles are rebuilt and redeployed
Apply a strict Content Security Policy (CSP) to limit script execution and outbound connections from production web applications

bash

# Remediation steps
npm install color@^5.0.2
rm -rf node_modules package-lock.json
npm cache clean --force
npm install
npm run build