CVE-2025-59330: error-ex npm Package Malware Vulnerability

CVE-2025-59330 Overview

CVE-2025-59330 affects the error-ex npm package, a widely depended-upon library that enables error subclassing and stack customization. On 8 September 2025, an attacker took over the maintainer's npm publishing account through a phishing campaign. The attacker published version 1.3.3, which was functionally identical to the prior patch release but carried a malicious payload. The payload activated only in browser contexts and attempted to redirect cryptocurrency transactions, including those handled by wallets such as MetaMask, to attacker-controlled addresses. The package was removed from the npm registry the same day, and the maintainer republished clean patch versions on 13 September to cache-bust private registries.

Critical Impact
Browser bundles built against error-ex@1.3.3 may exfiltrate or redirect cryptocurrency transactions to attacker-controlled wallets. Server-side and CLI consumers are not impacted.

Affected Products

error-ex npm package version 1.3.3
Browser bundles built with Babel, Rollup, Vite, Next.js, or similar tooling that included error-ex@1.3.3
Private npm registries or mirrors that cached the compromised version

Discovery Timeline

8 September 2025 - Compromised version 1.3.3 published to npm following maintainer account takeover; npm removes the package the same day
13 September 2025 - Maintainer publishes new clean patch versions to cache-bust private registries
2025-09-15 - CVE-2025-59330 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-59330

Vulnerability Analysis

CVE-2025-59330 is a software supply chain compromise classified under [CWE-506] (Embedded Malicious Code). The attacker phished the npm maintainer credentials for the error-ex package and used the legitimate publish path to push a tainted release. Because error-ex is a transitive dependency of many JavaScript projects, downstream consumers pulled the malicious version through standard dependency resolution without any visible code change at the application layer.

The injected payload was designed to operate only inside browser execution contexts. When bundled by tools such as Webpack, Rollup, Vite, or Next.js, the malicious code shipped to end users as part of normal application JavaScript. The payload inspected page activity for cryptocurrency wallet interactions, including MetaMask, and rewrote destination addresses so that transactions routed funds to attacker-controlled wallets.

Root Cause

The root cause is account compromise of a trusted maintainer through phishing, combined with the implicit trust model of public package registries. No vulnerability existed in the original error-ex source code. The malicious behavior was introduced exclusively in the published 1.3.3 artifact.

Attack Vector

The attack vector is network-based and indirect. Developers, build pipelines, and CDN-based browser includes pulled the tainted version through routine npm install or yarn operations. Once bundled, the payload executed in any end-user browser that loaded the application. The malware did not activate in Node.js server runtimes, command line tools, or test harnesses, narrowing detection signal during normal development. Refer to the GitHub Security Advisory and Socket's analysis for payload internals.

Detection Methods for CVE-2025-59330

Indicators of Compromise

Presence of error-ex@1.3.3 in package-lock.json, yarn.lock, or pnpm-lock.yaml
Browser bundles built between 8 September and 13 September 2025 that include the error-ex module
Outbound web traffic from end-user browsers to unknown cryptocurrency wallet addresses or unfamiliar domains following wallet interactions
Cached copies of error-ex@1.3.3 in private registries such as Verdaccio, Nexus, or Artifactory

Detection Strategies

Run npm ls error-ex across all JavaScript projects and flag any resolution to version 1.3.3
Scan built artifacts and CDN-hosted bundles for known payload strings documented in the Aikido analysis and OX Security writeup
Audit CI/CD logs for installs of error-ex@1.3.3 between 8 and 13 September 2025
Use software composition analysis (SCA) tooling to alert on packages flagged in the GitHub Security Advisory

Monitoring Recommendations

Monitor browser-side telemetry and Content Security Policy (CSP) reports for unexpected script behavior on pages handling wallet activity
Alert on developer workstations or build agents that resolved error-ex@1.3.3 during the compromise window
Track integrity hashes of deployed JavaScript bundles and compare against known-good baselines
Forward npm install logs and registry access logs to a central detection pipeline for retrospective hunting

How to Mitigate CVE-2025-59330

Immediate Actions Required

Upgrade error-ex to version 1.3.4 or later across every project and lockfile
Delete node_modules directories and reinstall dependencies from a clean state
Clear npm, yarn, and pnpm global caches with npm cache clean --force and equivalent commands
Rebuild and redeploy every browser bundle that may have been produced with the compromised version
Rotate any cryptocurrency wallet credentials or session tokens that may have been exposed through affected applications

Patch Information

The issue is resolved in error-ex@1.3.4, republished by the maintainer on 13 September 2025 to invalidate cached copies of 1.3.3 in private mirrors. Consult the GitHub Security Advisory GHSA-6jp5-hh4c-8c5h for the authoritative fix metadata.

Workarounds

Purge error-ex@1.3.3 from all private registries, registry mirrors, and proxy caches such as Verdaccio, Nexus, or Artifactory
Pin error-ex to >=1.3.4 in package.json and regenerate lockfiles to prevent reintroduction
Enforce npm audit signatures or Sigstore verification in CI to detect tampered packages
Restrict direct <script> inclusion of npm-hosted assets and serve only verified, integrity-hashed bundles to browsers

bash

# Configuration example
npm uninstall error-ex
rm -rf node_modules package-lock.json
npm cache clean --force
npm install error-ex@^1.3.4
npm ls error-ex