Malware Injection in color-string Package by Qix- Following Account Compromise

CVE-2025-59142

What is CVE-2025-59142?

The color-string package, a widely used parser and generator for CSS color strings, was compromised after the npm publishing account was taken over following a phishing attack. Affected version 2.1.1 was published, which, while functionally identical to its predecessor, contained a malicious payload designed to redirect cryptocurrency transactions to the attacker's addresses when utilized within a browser environment. It's important to acknowledge that this issue impacts projects where the package is included directly in a script or bundled through tools like Babel or Vite. Users are urged to update to version 2.1.2 or rebuild their bundled files to mitigate the risk of this malware, which specifically targets cryptocurrency wallets such as MetaMask. The npm registry has since removed the compromised version, and subsequent patch versions have been issued to assist users in replacing cached versions on private registries.

References