PT-2025-37743 · Npm · Simple-Swizzle

Informatic · Published 2025-09-08 · Updated 2025-09-20 · CVE-2025-59141

Positive Technologies (AI Summary)

CVSS v4.0

8.8

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Red

Name of the Vulnerable Software and Affected Versions simple-swizzle version 0.2.3 simple-swizzle versions prior to 0.2.4

Description The npm publishing account for simple-swizzle was compromised following a phishing attack. Version 0.2.3 was published with a malware payload designed to redirect cryptocurrency transactions within browser environments. Local, server, and command-line environments are not affected. The malware specifically targets cryptocurrency transactions and wallets such as MetaMask.

Recommendations Update to version 0.2.4. Completely remove the node modules directory. Clean the package manager's global cache. Rebuild any browser bundles from scratch. Purge the compromised versions from any private registries or registry mirrors.

Exploit

Fix

RCE

Weakness Enumeration

CWE-506

Related Identifiers

CVE-2025-59141

GHSA-9G9J-RGGX-7FMG

GHSA-WWPX-H6G5-C7X6

MAL-2025-46978

Affected Products

Simple-Swizzle

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59141.json · Exploit
• https://osv.dev/vulnerability/GHSA-9g9j-rggx-7fmg · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-59141 · Vendor Advisory
• https://osv.dev/vulnerability/MAL-2025-46978 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-59141 · Security Note
• https://github.com/debug-js/debug/issues/1005 · Note
• https://github.com/github/advisory-database/issues/6099 · Note
• https://github.com/Qix-/node-simple-swizzle/security/advisories/GHSA-9g9j-rggx-7fmg · Note
• https://github.com/Qix-/node-simple-swizzle · Note
• https://ox.security/blog/npm-packages-compromised · Note
• https://t.me/CVEtracker/32549 · Telegram Post
• https://twitter.com/CveFindCom/status/1967674745136013661 · Twitter Post
• https://bleepingcomputer.com/news/security/hackers-hijack-npm-packages-with-2-billion-weekly-downloads-in-supply-chain-attack · Note
• https://twitter.com/CVEnew/status/1969292011736805767 · Twitter Post
• https://aikido.dev/blog/npm-debug-and-chalk-packages-compromised · Note