PT-2025-37743 · Npm · Simple-Swizzle

Informatic · Publicado 2025-09-08 · Atualizado 2025-09-20 · CVE-2025-59141

Positive Technologies (AI Summary)

CVSS v4.0

8.8

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Red

Name of the Vulnerable Software and Affected Versions simple-swizzle version 0.2.3 simple-swizzle versions prior to 0.2.4

Description The npm publishing account for simple-swizzle was compromised following a phishing attack. Version 0.2.3 was published with a malware payload designed to redirect cryptocurrency transactions within browser environments. Local, server, and command-line environments are not affected. The malware specifically targets cryptocurrency transactions and wallets such as MetaMask.

Recommendations Update to version 0.2.4. Completely remove the node modules directory. Clean the package manager's global cache. Rebuild any browser bundles from scratch. Purge the compromised versions from any private registries or registry mirrors.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-506

Identificadores relacionados

CVE-2025-59141

GHSA-9G9J-RGGX-7FMG

GHSA-WWPX-H6G5-C7X6

MAL-2025-46978

Produtos afetados

Simple-Swizzle

Referências · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59141.json · Exploit
• https://github.com/debug-js/debug/issues/1005 · Nota
• https://github.com/github/advisory-database/issues/6099 · Nota
• https://github.com/Qix-/node-simple-swizzle/security/advisories/GHSA-9g9j-rggx-7fmg · Nota
• https://github.com/Qix-/node-simple-swizzle · Nota
• https://osv.dev/vulnerability/GHSA-9g9j-rggx-7fmg · Aviso do Fabricante
• https://ox.security/blog/npm-packages-compromised · Nota
• https://t.me/CVEtracker/32549 · Publicação no Telegram
• https://twitter.com/CveFindCom/status/1967674745136013661 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2025-59141 · Aviso do Fabricante
• https://osv.dev/vulnerability/MAL-2025-46978 · Aviso do Fabricante
• https://bleepingcomputer.com/news/security/hackers-hijack-npm-packages-with-2-billion-weekly-downloads-in-supply-chain-attack · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-59141 · Nota de Segurança
• https://twitter.com/CVEnew/status/1969292011736805767 · Publicação no Twitter
• https://aikido.dev/blog/npm-debug-and-chalk-packages-compromised · Nota