CVE-2025-59162: color-convert Malicious XSS Vulnerability

CVE-2025-59162 Overview

CVE-2025-59162 documents a supply chain compromise of the color-convert npm package, a widely used JavaScript library that provides plain color conversion functions. On 8 September 2025, an attacker took over the npm publishing account for color-convert via a phishing attack and published version 3.1.1. The malicious release is functionally identical to the prior patch version but contains a payload that targets cryptocurrency transactions inside browser environments. The malware attempts to rewrite wallet destinations, including MetaMask transactions, to attacker-controlled addresses. The issue is resolved in version 3.1.2 [CWE-506: Embedded Malicious Code].

Critical Impact
Browser bundles built with the compromised color-convert@3.1.1 may silently redirect cryptocurrency transactions to attacker-controlled wallets.

Affected Products

color-convert npm package version 3.1.1
Browser bundles built with bundlers such as Babel, Rollup, Vite, or Next.js that included color-convert@3.1.1
Private npm registries or mirrors that cached the compromised release

Discovery Timeline

8 September 2025 - npm publishing account compromised via phishing; malicious 3.1.1 released and later removed by npm
13 September 2025 - Package owner published new patch versions to cache-bust private registries
15 September 2025 - CVE-2025-59162 published to NVD
15 April 2026 - Last updated in NVD database

Technical Details for CVE-2025-59162

Vulnerability Analysis

The compromise stems from account takeover rather than a code defect in color-convert itself. The attacker phished the maintainer credentials and published version 3.1.1 containing an embedded payload. The payload only activates in browser execution contexts, leaving server-side Node.js, command line tools, and local build steps unaffected. The malware hooks cryptocurrency wallet interactions and rewrites destination addresses before transactions are signed. Because color-convert is a transitive dependency of common packages like chalk and debug, the blast radius extends to applications that never directly installed it.

Root Cause

The root cause is a maintainer account takeover that allowed an unauthorized publish to the npm registry. Downstream projects that resolved color-convert@3.1.1 during install or bundling integrated the malicious code into shipped artifacts.

Attack Vector

Attackers used the published package to deliver browser-side code that intercepts wallet transactions. Exploitation requires the malicious version to be present in a JavaScript bundle delivered to an end user with a cryptocurrency wallet such as MetaMask. The malicious code does not require any direct interaction with the upstream color-convert API to fire.

No public exploitation code is required to describe the attack flow. See the GitHub Security Advisory and the Socket Blog on the supply chain attack for payload-level details.

Detection Methods for CVE-2025-59162

Indicators of Compromise

Presence of color-convert@3.1.1 in package-lock.json, yarn.lock, or pnpm-lock.yaml
Built browser bundles containing wallet address regular expressions or window.ethereum hooks not present in earlier builds
Outbound calls to attacker-controlled cryptocurrency addresses from end user browsers
Cached copies of color-convert@3.1.1 tarballs in private registry storage

Detection Strategies

Run npm ls color-convert and pnpm why color-convert across all repositories to enumerate transitive usage
Scan committed lockfiles in source control for the literal string color-convert paired with 3.1.1
Inspect built bundles for cryptocurrency address patterns and wallet provider hooks introduced after 8 September 2025
Use a software composition analysis tool to flag color-convert versions outside the 3.1.2 or later patched lines

Monitoring Recommendations

Alert on any new npm dependency publishes that occur outside maintainer release windows
Monitor CI/CD logs for installs that pulled color-convert@3.1.1 between 8 September and 13 September 2025
Track outbound network connections from production web assets to known cryptocurrency drainer infrastructure

How to Mitigate CVE-2025-59162

Immediate Actions Required

Update color-convert to 3.1.2 or later across all dependency trees
Delete the local node_modules directory and reinstall from a clean lockfile
Purge the package manager global cache using npm cache clean --force, yarn cache clean, or pnpm store prune
Rebuild and redeploy any browser bundles produced between 8 September 2025 and remediation
Purge color-convert@3.1.1 from any private registry or mirror caches

Patch Information

The maintainer published color-convert@3.1.2 to resolve the compromise and to invalidate cached copies of the malicious version on private registries. Consumers should pin to 3.1.2 or later and verify the resolved version in their lockfile. Reference the GitHub Security Advisory GHSA-pxx3-g568-hxr4 for the official fix metadata.

Workarounds

Pin color-convert to a known-good version such as 3.1.0 via lockfile overrides until upgrading to 3.1.2
Use npm overrides or pnpm resolutions to force transitive dependencies away from 3.1.1
Block the specific 3.1.1 version at the proxy registry layer to prevent reintroduction

bash

# package.json override to force the patched version
{
  "overrides": {
    "color-convert": "3.1.2"
  }
}

# Clean rebuild sequence
rm -rf node_modules
npm cache clean --force
npm install
npm run build