Malware Payload in Backslash Package Affects npm Users and Cryptocurrency Transactions

CVE-2025-59140

What is CVE-2025-59140?

The Backslash package faced a security breach when its npm account was compromised, leading to the release of version 0.2.1 which included a malicious payload. This malware specifically targets cryptocurrency transactions, attempting to reroute funds from wallets like MetaMask. Users are advised to upgrade to version 0.2.2, fully clear their node_modules directory, and rebuild any browser bundles to ensure the removal of this threat. The npm registry has since removed the malicious version to prevent further distribution.

References