CVE-2025-59330 Overview
CVE-2025-59330 affects the error-ex npm package, a widely used JavaScript library for error subclassing and stack customization. On 8 September 2025, attackers phished the maintainer's npm publishing account and released version 1.3.3. The malicious release was functionally identical to the prior patch but carried an embedded payload that targets cryptocurrency transactions in browser environments. The injected code attempts to redirect transactions and intercept wallets such as MetaMask. Server-side, command line, and local Node.js usage are not affected. npm removed the package from the registry the same day, and the maintainer published 1.3.4 on 13 September to cache-bust private registries.
Critical Impact
Browser bundles built with error-ex@1.3.3 may silently reroute cryptocurrency transactions to attacker-controlled wallet addresses.
Affected Products
- error-ex npm package version 1.3.3
- Browser bundles built with bundlers such as Babel, Rollup, Vite, webpack, or Next.js that included error-ex@1.3.3
- Private npm registries or mirrors caching the compromised version
Discovery Timeline
- 8 September 2025 - Maintainer npm account compromised via phishing; malicious error-ex@1.3.3 published and later removed by npm
- 13 September 2025 - Maintainer publishes patched version 1.3.4 to cache-bust private registries
- 2025-09-15 - CVE-2025-59330 published to NVD
- 2026-04-15 - Last updated in NVD database
Technical Details for CVE-2025-59330
Vulnerability Analysis
The issue is a software supply chain compromise classified as embedded malicious code [CWE-506]. The attacker obtained publishing rights to the error-ex package through a phishing campaign against the maintainer's npm account. They then published a tampered patch release containing wallet-stealing logic alongside the original library code, so dependents installed the malicious version transparently through normal semver resolution. Because error-ex is a transitive dependency of many popular packages, the blast radius extends well beyond direct consumers.
Root Cause
The root cause is account takeover of a trusted npm maintainer rather than a code defect in error-ex itself. The compromised credentials allowed the attacker to push 1.3.3 to the public registry, bypassing all consumer-side trust assumptions about the publisher. The malicious build was functionally indistinguishable from the legitimate prior release except for the appended payload.
Attack Vector
The payload activates only inside browser execution contexts. It hooks JavaScript APIs used by cryptocurrency wallets including MetaMask, inspects pending transactions, and rewrites destination addresses to attacker-controlled wallets before the user signs. Local Node.js processes, command-line tools, and server-side applications never execute the malicious branch. The attack reaches end users when a vulnerable bundle is shipped to the browser, meaning any production deployment that compiled in error-ex@1.3.3 between 8 September and the rebuild remains exposed until the artifact is regenerated.
No public proof-of-concept code is required because the malicious build itself is the exploit. See the GitHub Security Advisory GHSA-6jp5-hh4c-8c5h and the Socket analysis of the qix compromise for payload details.
Detection Methods for CVE-2025-59330
Indicators of Compromise
- Presence of error-ex@1.3.3 in package-lock.json, yarn.lock, or pnpm-lock.yaml
- Browser bundles built between 8 September 2025 and the package rebuild that include error-ex code referencing wallet address regular expressions
- Outbound requests from end-user browsers to unfamiliar domains coinciding with wallet activity on production web applications
- Cached copies of error-ex@1.3.3 in private npm registries, Verdaccio, Artifactory, or Nexus mirrors
Detection Strategies
- Audit dependency trees with npm ls error-ex, yarn why error-ex, or pnpm why error-ex and flag any 1.3.3 resolution
- Scan committed lockfiles and built artifacts in CI for the string error-ex paired with version 1.3.3
- Inspect browser bundles for injected wallet-targeting code such as 0x[a-fA-F0-9]{40} address substitution patterns
- Compare published tarball hashes against the maintainer's republished 1.3.4 release to identify tampered caches
Monitoring Recommendations
- Continuously monitor SCA (Software Composition Analysis) tooling for advisories tagged GHSA-6jp5-hh4c-8c5h
- Alert on browser telemetry showing modifications to window.ethereum or wallet provider objects
- Track egress traffic from web frontends for cryptocurrency-related domain lookups initiated from user sessions
- Review npm publish logs and 2FA enforcement status for all maintainer accounts in your supply chain
How to Mitigate CVE-2025-59330
Immediate Actions Required
- Upgrade error-ex to version 1.3.4 or later across all projects and lockfiles
- Delete node_modules entirely and reinstall dependencies after clearing npm cache clean --force or the equivalent for yarn and pnpm
- Rebuild every browser bundle from scratch and redeploy; do not reuse artifacts produced while 1.3.3 was resolvable
- Purge error-ex@1.3.3 from private registries, mirrors, and CDN caches
Patch Information
The maintainer resolved the issue in error-ex@1.3.4, published on 13 September 2025. The patched release is functionally equivalent to 1.3.2 without the injected payload and was issued specifically to cache-bust private registries still serving the compromised tarball. Refer to the GitHub Security Advisory for the authoritative remediation guidance.
Workarounds
- Pin error-ex to a known-good version such as 1.3.2 or >=1.3.4 using overrides in package.json or resolutions for yarn
- Enforce npm package provenance and require 2FA on all maintainer accounts in your organization's supply chain
- Use a vetted internal registry mirror that blocks installation of yanked or advisory-flagged versions
- For high-risk frontends handling cryptocurrency, add Subresource Integrity (SRI) and Content Security Policy (CSP) controls to constrain third-party script behavior
# Remediation example
npm uninstall error-ex
rm -rf node_modules package-lock.json
npm cache clean --force
npm install error-ex@^1.3.4
npm run build # Rebuild browser bundles from clean dependencies
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
