CVE-2025-59331: is-arrayish npm Package Malware Attack

CVE-2025-59331 Overview

CVE-2025-59331 is a supply chain compromise affecting the popular is-arrayish npm package, which checks if an object can be used like an Array. On 8 September 2025, attackers took over the package's npm publishing account through a phishing attack and published version 0.3.3. The release was functionally identical to the previous patch version but contained an embedded malware payload that hijacks cryptocurrency transactions inside browser environments. The payload targets wallets such as MetaMask by redirecting transactions to attacker-controlled addresses. Server-side, command-line, and local environments are not affected. The issue is resolved in version 0.3.4, published on 13 September 2025 to cache-bust private registries.

Critical Impact
Browser bundles built with the compromised is-arrayish@0.3.3 package silently rewrite cryptocurrency wallet transactions, redirecting funds to attacker-controlled addresses.

Affected Products

is-arrayish npm package version 0.3.3
Browser bundles built with tools such as Babel, Rollup, Vite, or Next.js that include the compromised version
Private npm registries or mirrors caching the compromised tarball

Discovery Timeline

2025-09-08 - Maintainer's npm account taken over via phishing; malicious 0.3.3 published and later removed from the npm registry the same day
2025-09-13 - Package owner publishes 0.3.4 to cache-bust private registries
2025-09-15 - CVE-2025-59331 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-59331

Vulnerability Analysis

The vulnerability is an embedded malicious payload [CWE-506] introduced into a legitimate open-source package through maintainer account takeover. The trojanized is-arrayish@0.3.3 retains the original API surface, so applications continue to function normally. The malicious code activates only when the package is loaded into a browser context, evading detection during server-side testing or CLI usage. Once active in the browser, the payload hooks into cryptocurrency wallet APIs such as MetaMask and rewrites transaction destination addresses before they are signed by the user. Because is-arrayish is a transitive dependency of widely used libraries, the malicious code propagated into thousands of downstream bundles within hours of publication.

Root Cause

The root cause is the compromise of an npm publishing credential through a targeted phishing campaign against the package maintainer. npm permitted the publish without out-of-band verification, allowing the attacker to push a tagged patch release containing trojan code. The npm ecosystem's implicit trust of published patch versions means downstream consumers automatically received the malicious version through semver ranges.

Attack Vector

The attack vector is network-based and indirect. Developers and CI systems pulling is-arrayish from npm between publication and removal on 8 September 2025 received the compromised tarball. The payload only executes in browser bundles, so the attack reaches end users when web applications built against the compromised dependency are deployed to production. Victims interact normally with their wallet, but the payload swaps the recipient address at signing time. See the GitHub Security Advisory and Socket.dev analysis for payload details.

Detection Methods for CVE-2025-59331

Indicators of Compromise

Presence of is-arrayish@0.3.3 in package-lock.json, yarn.lock, or pnpm-lock.yaml
Browser bundles containing obfuscated JavaScript that references wallet provider objects such as window.ethereum alongside transaction-rewriting logic
Outbound requests from user browsers to unfamiliar domains shortly before signed wallet transactions
Cached is-arrayish-0.3.3.tgz artifacts in private registry storage or CI build caches

Detection Strategies

Run npm ls is-arrayish and npm audit across repositories to identify any resolution to 0.3.3
Use Software Composition Analysis (SCA) tooling to scan production bundles for the compromised version hash
Inspect deployed browser assets for code patterns that intercept wallet RPC calls or replace base58/hex address strings
Cross-reference build artifacts against published advisories listing the trojanized package versions

Monitoring Recommendations

Alert on any dependency resolution that pins or floats to is-arrayish@0.3.3 in CI build logs
Monitor private registry access logs for downloads of the compromised tarball after 8 September 2025
Track outbound DOM-based network telemetry from web applications interacting with cryptocurrency wallets
Watch SCM commits that modify lockfiles to reintroduce vulnerable versions during merges or rebases

How to Mitigate CVE-2025-59331

Immediate Actions Required

Upgrade is-arrayish to version 0.3.4 or later across all projects and verify transitive resolutions
Delete node_modules directories and reinstall to ensure no cached copy of 0.3.3 remains
Purge package manager global caches with npm cache clean --force, yarn cache clean, or pnpm store prune
Rebuild and redeploy all browser bundles produced with Webpack, Rollup, Vite, Next.js, Babel, or similar tooling

Patch Information

The maintainer published is-arrayish@0.3.4 on 13 September 2025 to resolve the issue and force private-registry cache invalidation. The malicious 0.3.3 version was removed from the public npm registry on 8 September 2025. Operators of private registries or mirrors must explicitly purge the compromised tarball from their storage, since registry removal alone does not affect mirrored caches.

Workarounds

Pin is-arrayish to a known-safe version such as 0.3.2 or 0.3.4 using exact-version constraints in package.json
Use npm overrides, yarn resolutions, or pnpm.overrides to force the safe version across transitive dependencies
Block the compromised version at the registry proxy layer (e.g., Verdaccio, Artifactory, Nexus) until caches are purged
Require maintainer two-factor authentication and provenance attestation for all internal package consumption

bash

# Force a safe resolution across the dependency tree (package.json)
{
  "overrides": {
    "is-arrayish": "0.3.4"
  },
  "resolutions": {
    "is-arrayish": "0.3.4"
  }
}

# Clean and rebuild
rm -rf node_modules
npm cache clean --force
npm install
npm run build