PT-2025-37747 · Npm · Color-Convert

Qix- · Published 2025-09-08 · Updated 2025-09-20 · CVE-2025-59162

Positive Technologies (AI Summary)

CVSS v4.0

8.8

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:A/U:Red

Name of the Vulnerable Software and Affected Versions color-convert versions prior to 3.1.2

Description The npm package color-convert was compromised through a phishing attack on the publishing account. A malicious version (3.1.1) was published containing a payload designed to redirect cryptocurrency transactions in browser environments. Environments such as local, server, and command line applications are not affected. The malware specifically targets cryptocurrency transactions and wallets like MetaMask. The compromised package was removed from the npm registry, and new patch versions were published to assist users with private registries.

Recommendations Update to version 3.1.2. Completely remove the node modules directory. Clean the package manager's global cache. Rebuild any browser bundles from scratch. Purge the compromised versions from any caches if operating private registries or registry mirrors.

Exploit

Fix

RCE

Weakness Enumeration

CWE-506

Related Identifiers

CVE-2025-59162

GHSA-CH7M-M9RF-8GVV

GHSA-PXX3-G568-HXR4

MAL-2025-46971

Affected Products

Color-Convert

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59162.json · Exploit
• https://osv.dev/vulnerability/GHSA-pxx3-g568-hxr4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-59162 · Security Note
• https://osv.dev/vulnerability/MAL-2025-46971 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-59162 · Vendor Advisory
• https://github.com/debug-js/debug/issues/1005 · Note
• https://github.com/github/advisory-database/issues/6099 · Note
• https://github.com/Qix-/color-convert/security/advisories/GHSA-pxx3-g568-hxr4 · Note
• https://github.com/Qix-/color-convert · Note
• https://socket.dev/blog/npm-author-qix-compromised-in-major-supply-chain-attack · Note
• https://aikido.dev/blog/npm-debug-and-chalk-packages-compromised · Note
• https://twitter.com/CVEnew/status/1969292006376530194 · Twitter Post
• https://t.me/CVEtracker/32554 · Telegram Post
• https://github.com/advisories/GHSA-ch7m-m9rf-8gvv · Note
• https://ox.security/blog/npm-packages-compromised · Note