PT-2025-37746 · Npm · Debug

Charlie Eriksen · Published 2025-09-08 · Updated 2025-09-30 · CVE-2025-59144

Positive Technologies (AI Summary)

CVSS v4.0

8.8

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Red

Name of the Vulnerable Software and Affected Versions debug versions 4.4.2

Description The npm publishing account for debug was compromised following a phishing attack on September 8, 2025. Version 4.4.2 was published with a malicious payload designed to redirect cryptocurrency transactions within browser environments. Environments not utilizing the package in a browser context, such as local, server, or command-line applications, are not affected. The malware specifically targets cryptocurrency transactions and wallets like MetaMask.

Recommendations Upgrade to the latest patch version, completely remove the node modules directory, clean the package manager's global cache, and rebuild any browser bundles. Those operating private registries or registry mirrors should purge the compromised versions from any caches. If suspicious behavior persists after performing these steps, contact the package owner via Bluesky at https://bsky.app/profile/bad-at-computer.bsky.social or through the tracking issue on the debug repository at https://github.com/debug-js/debug/issues/1005.

Exploit

Fix

RCE

Weakness Enumeration

CWE-506

Related Identifiers

BDU:2026-00374

CVE-2025-59144

GHSA-4X49-VF9V-38PX

GHSA-8MGJ-VMR8-FRR6

MAL-2025-46974

Affected Products

Debug

References · 21

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59144.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-59144 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-00374 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-59144 · Security Note
• https://osv.dev/vulnerability/GHSA-4x49-vf9v-38px · Vendor Advisory
• https://osv.dev/vulnerability/MAL-2025-46974 · Vendor Advisory
• https://github.com/debug-js/debug/issues/1005 · Note
• https://github.com/debug-js/debug/security/advisories/GHSA-4x49-vf9v-38px · Note
• https://github.com/debug-js/debug · Note
• https://github.com/github/advisory-database/issues/6099 · Note
• https://ox.security/blog/npm-packages-compromised · Note
• https://github.com/advisories/GHSA-8mgj-vmr8-frr6 · Note
• https://t.me/CVEtracker/32552 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1967735315436564508 · Twitter Post
• https://twitter.com/CVEnew/status/1969292009119666682 · Twitter Post