CVE-2025-59144: Debug npm Package Malware Vulnerability

CVE-2025-59144 Overview

CVE-2025-59144 is a supply chain compromise affecting the widely used debug JavaScript debugging utility on npm. On 8 September 2025, an attacker took over the npm publishing account for debug through a phishing attack and published version 4.4.2. The malicious release was functionally identical to the prior patch version but included a payload designed to redirect cryptocurrency transactions to attacker-controlled addresses inside browser environments. The vulnerability is classified under [CWE-506: Embedded Malicious Code]. The maintainer published clean releases on 13 September, and the issue is resolved in version 4.4.3.

Critical Impact
Browser bundles built with the compromised debug@4.4.2 package can silently hijack cryptocurrency transactions involving wallets such as MetaMask, redirecting funds to attacker-controlled addresses.

Affected Products

debug npm package version 4.4.2
Browser bundles built with the compromised version using tools such as Babel, Rollup, Vite, or Next.js
Private npm registries and registry mirrors that cached the compromised version

Discovery Timeline

8 September 2025 - Attacker phishes the npm publishing account and releases malicious debug@4.4.2
8 September 2025 - npm removes the offending package from the public registry
13 September 2025 - Maintainer publishes new clean patch versions to cache-bust private registries
2025-09-15 - CVE-2025-59144 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-59144

Vulnerability Analysis

The compromised debug@4.4.2 package retained the original debugging functionality while injecting additional code that activates only inside browser execution contexts. The payload hooks cryptocurrency wallet interfaces, including MetaMask, and rewrites transaction destination addresses before they are signed. Local Node.js environments, server runtimes, and command-line tooling that import debug are not affected because the malicious branch only triggers in the browser. The classification [CWE-506] reflects that the harmful behavior was deliberately embedded code rather than a logic flaw in legitimate functionality.

Root Cause

The root cause is account takeover of an upstream maintainer through phishing, not a software defect. The attacker used valid publisher credentials to push a tampered release to npm, which downstream consumers then pulled through normal dependency resolution. Because debug is a transitive dependency of thousands of packages, the malicious version propagated rapidly through CI pipelines and bundlers.

Attack Vector

Exploitation requires no interaction with a victim system beyond installing or building against the poisoned version. When a developer or build pipeline resolved debug@4.4.2 and produced a browser bundle, the malicious code was embedded into the resulting JavaScript. Each visitor of the affected web application then executed the wallet-hijacking logic in their browser. Bundles produced during the compromise window remain dangerous until rebuilt, even after the registry was cleaned. The malicious code targets window.ethereum and similar wallet provider objects to intercept transaction calls.

Detection Methods for CVE-2025-59144

Indicators of Compromise

Presence of debug version 4.4.2 in package-lock.json, yarn.lock, or pnpm-lock.yaml
Browser bundles containing string references to wallet provider objects such as window.ethereum alongside debug module code
Outbound network connections from end-user browsers to attacker-controlled cryptocurrency addresses
Cached copies of debug@4.4.2 in private npm registries, Verdaccio mirrors, or Artifactory repositories

Detection Strategies

Run npm ls debug and npm audit across all repositories to identify any resolved version of 4.4.2
Use software composition analysis (SCA) tooling to scan lockfiles and built artifacts for the compromised version
Inspect deployed browser bundles for injected wallet-hooking code patterns flagged in the GitHub Security Advisory
Cross-reference build server logs against the 8\u201313 September 2025 window when the malicious package was reachable

Monitoring Recommendations

Continuously monitor dependency manifests and CI artifacts for known-malicious npm versions using a supply chain scanner
Alert on any new install of debug@4.4.2 from internal registries or proxies
Log and review build pipeline output hashes to detect unexpected bundle changes

How to Mitigate CVE-2025-59144

Immediate Actions Required

Upgrade debug to version 4.4.3 or later across all projects and lockfiles
Delete node_modules directories and reinstall dependencies from a clean state
Purge package manager global caches with npm cache clean --force, yarn cache clean, or pnpm store prune
Rebuild and redeploy every browser bundle that may have been produced with the compromised version
Purge debug@4.4.2 from any private npm registry, mirror, or artifact repository

Patch Information

The maintainer resolved the issue in debug@4.4.3. Refer to the GitHub Security Advisory GHSA-4x49-vf9v-38px and the debug-js issue tracker for maintainer guidance. Additional analyses are available from Socket, Aikido, and Ox Security.

Workarounds

Pin debug to a known-good version such as 4.4.1 or 4.4.3 using exact version specifiers in package.json
Enforce npm overrides or resolutions blocks to prevent transitive resolution of 4.4.2
Require two-factor authentication and provenance attestations for all internal npm publishers to reduce future account-takeover risk

bash

# Configuration example: enforce a safe debug version across transitive deps
# package.json
{
  "overrides": {
    "debug": "4.4.3"
  }
}

# Reinstall cleanly after applying the override
rm -rf node_modules package-lock.json
npm cache clean --force
npm install
npm ls debug