Function Argument Manipulation Vulnerability in Simple-Swizzle by npm

CVE-2025-59141

What is CVE-2025-59141?

The simple-swizzle npm package was compromised after the account of its maintainer was taken over through a phishing attack. The malicious version 0.2.3 has been reported to contain a payload that redirects cryptocurrency transactions to unauthorized addresses, primarily affecting users operating in browser contexts. Despite npm's swift removal of the compromised version, users who might have cached this version in private registries remain at risk. It is recommended that users update to version 0.2.4, fully delete their node_modules directory, clean their package manager's global cache, and rebuild any affected browser bundles to mitigate the risk.

References