PT-2025-37744 · Npm · Color-String

Qix · Publicado 2025-09-08 · Atualizado 2025-09-20 · CVE-2025-59142

Positive Technologies (AI Summary)

CVSS v4.0

8.8

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Red

Name of the Vulnerable Software and Affected Versions color-string version 2.1.1

Description The npm publishing account for color-string was compromised following a phishing attack. Version 2.1.1 was published with a malicious payload designed to redirect cryptocurrency transactions within browser environments. The malware specifically targets cryptocurrency transactions and wallets such as MetaMask. Local, server, and command-line environments are not affected.

Recommendations Update to version 2.1.2. Completely remove the node modules directory. Clean the package manager's global cache. Rebuild any browser bundles from scratch. Purge the compromised versions from any private registry caches.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-506

Identificadores relacionados

BDU:2026-00172

CVE-2025-59142

GHSA-286P-VC9P-P5QV

GHSA-3Q87-F72R-3GM6

MAL-2025-46973

Produtos afetados

Color-String

Referências · 19

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59142.json · Exploit
• https://github.com/debug-js/debug/issues/1005 · Nota
• https://github.com/github/advisory-database/issues/6099 · Nota
• https://github.com/Qix-/color-string/security/advisories/GHSA-286p-vc9p-p5qv · Nota
• https://github.com/Qix-/color-string · Nota
• https://ox.security/blog/npm-packages-compromised · Nota
• https://twitter.com/CVEnew/status/1969292007387320752 · Publicação no Twitter
• https://osv.dev/vulnerability/MAL-2025-46973 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2026-00172 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2025-59142 · Nota de Segurança
• https://github.com/advisories/GHSA-3q87-f72r-3gm6 · Nota
• https://twitter.com/CveFindCom/status/1967674715339624655 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2025-59142 · Aviso do Fabricante
• https://t.me/CVEtracker/32550 · Publicação no Telegram
• https://bsky.app/profile/bad-at-computer.bsky.social · Nota