PT-2025-37744 · Npm · Color-String

Qix · Published 2025-09-08 · Updated 2025-09-20 · CVE-2025-59142

Positive Technologies (AI Summary)

CVSS v4.0

8.8

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Red

Name of the Vulnerable Software and Affected Versions color-string version 2.1.1

Description The npm publishing account for color-string was compromised following a phishing attack. Version 2.1.1 was published with a malicious payload designed to redirect cryptocurrency transactions within browser environments. The malware specifically targets cryptocurrency transactions and wallets such as MetaMask. Local, server, and command-line environments are not affected.

Recommendations Update to version 2.1.2. Completely remove the node modules directory. Clean the package manager's global cache. Rebuild any browser bundles from scratch. Purge the compromised versions from any private registry caches.

Exploit

Fix

RCE

Weakness Enumeration

CWE-506

Related Identifiers

BDU:2026-00172

CVE-2025-59142

GHSA-286P-VC9P-P5QV

GHSA-3Q87-F72R-3GM6

MAL-2025-46973

Affected Products

Color-String

References · 19

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59142.json · Exploit
• https://osv.dev/vulnerability/MAL-2025-46973 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-00172 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-59142 · Security Note
• https://osv.dev/vulnerability/CVE-2025-59142 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-286p-vc9p-p5qv · Vendor Advisory
• https://github.com/debug-js/debug/issues/1005 · Note
• https://github.com/github/advisory-database/issues/6099 · Note
• https://github.com/Qix-/color-string/security/advisories/GHSA-286p-vc9p-p5qv · Note
• https://github.com/Qix-/color-string · Note
• https://ox.security/blog/npm-packages-compromised · Note
• https://twitter.com/CVEnew/status/1969292007387320752 · Twitter Post
• https://github.com/advisories/GHSA-3q87-f72r-3gm6 · Note
• https://twitter.com/CveFindCom/status/1967674715339624655 · Twitter Post
• https://t.me/CVEtracker/32550 · Telegram Post