PT-2025-37749 · Npm · Is-Arrayish

Informatic · Published 2025-09-08 · Updated 2025-09-20 · CVE-2025-59331

Positive Technologies (AI Summary)

CVSS v4.0

8.8

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:A/U:Red

Name of the Vulnerable Software and Affected Versions is-arrayish versions prior to 0.3.4

Description The is-arrayish package was compromised through a phishing attack on an npm publishing account. Version 0.3.3 was published with a malware payload designed to redirect cryptocurrency transactions in browser environments, specifically targeting cryptocurrency wallets such as MetaMask. Local, server, and command-line environments are not affected. The malicious package was removed from the npm registry on September 8th, and new patch versions were published on September 13th to assist with cache-busting.

Recommendations Update to version 0.3.4 or later. Completely remove the node modules directory. Clean the package manager's global cache. Rebuild any browser bundles from scratch. Purge the compromised versions from any caches operating on private registries or registry mirrors.

Exploit

Fix

RCE

Weakness Enumeration

CWE-506

Related Identifiers

CVE-2025-59331

GHSA-FRH7-2F84-V9MW

GHSA-HFM8-9JRF-7G9W

MAL-2025-46977

Affected Products

Is-Arrayish

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59331.json · Exploit
• https://osv.dev/vulnerability/GHSA-frh7-2f84-v9mw · Vendor Advisory
• https://osv.dev/vulnerability/MAL-2025-46977 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-59331 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-59331 · Security Note
• https://github.com/debug-js/debug/issues/1005 · Note
• https://github.com/github/advisory-database/issues/6099 · Note
• https://github.com/Qix-/node-is-arrayish/security/advisories/GHSA-frh7-2f84-v9mw · Note
• https://github.com/Qix-/node-is-arrayish · Note
• https://socket.dev/blog/npm-author-qix-compromised-in-major-supply-chain-attack · Note
• https://aikido.dev/blog/npm-debug-and-chalk-packages-compromised · Note
• https://twitter.com/CVEnew/status/1969292004434583954 · Twitter Post
• https://github.com/advisories/GHSA-hfm8-9jrf-7g9w · Note
• https://ox.security/blog/npm-packages-compromised · Note
• https://twitter.com/CveFindCom/status/1967674562214068504 · Twitter Post